Gmail Integration

Gmail integration - Send emails, manage labels, and automate Gmail workflows with full OAuth2 support

Security Scan

The skill's stated capabilities (full OAuth2 support) and required inputs look plausible for a Gmail integration, but the code and instructions do not implement an OAuth2 flow and contain incorrect API usage, so the pieces are incoherent and the skill will not behave as promised without modification.

Purpose & Capability

The name/description and required env vars (GMAIL_CLIENT_ID, GMAIL_CLIENT_SECRET) match a Gmail integration. However, the code never implements an OAuth2 token exchange or attaches Authorization headers to Gmail API calls. The code also uses an incorrect endpoint string (e.g., '.../messages.send' instead of the expected '/messages/send' path), so it cannot actually call Gmail on behalf of a user. Claiming 'Full OAuth2 support' in SKILL.md is inconsistent with the code.

Instruction Scope

SKILL.md instructs you to create OAuth credentials and set env vars, but does not explain how the skill obtains or stores access/refresh tokens, nor how to complete the OAuth consent/redirect flow. The runtime instructions and code do not direct the agent to perform an OAuth handshake or to prompt the user for an authorization code, so runtime behavior will either fail or require ad-hoc manual steps. The instructions are therefore incomplete and grant the agent ambiguous discretion to attempt network calls without proper auth.

Install Mechanism

No install spec or external downloads are included; the skill is instruction-only with a single Python file. That minimizes install-time risk (nothing is fetched or extracted).

Credentials

Requesting GMAIL_CLIENT_ID and GMAIL_CLIENT_SECRET is reasonable for an app that performs OAuth. However, those two values alone are insufficient for API access — the code should obtain and use access tokens. There are no other environment variables or unrelated credentials requested, so the scope of requested secrets is narrow but currently misapplied.

Persistence & Privilege

The skill is not marked always:true and does not request system-wide configuration or modify other skills. It does read environment variables at module import, which is normal for credentials.

What to consider before installing

This skill claims 'full OAuth2 support' but the code does not perform the OAuth token exchange or include Authorization headers, and it uses an incorrect API path — in short, it won't work as advertised. Before installing: (1) review or request fixes to the code so it implements the OAuth2 flow (authorization code or device flow), exchanges client_id/secret for tokens, and sends 'Authorization: Bearer <access_token>' with requests; (2) test with a throwaway Google account / limited-scope credentials, not your primary account; (3) avoid pasting production client_secret into untrusted skills — if you must provide secrets, ensure you understand where tokens are stored and whether the skill transmits them elsewhere; (4) ask the author to correct endpoint URLs and document token storage/refresh behavior. Because the pieces don't line up, treat this skill as non-functional and review or fix the implementation before giving it real credentials.

Gmail integration skill for OpenClaw. Send emails, manage labels, and automate Gmail workflows.

Capabilities

• Send emails via Gmail API
• List recent emails from inbox
• Create and manage custom labels
• Full OAuth2 support for secure authentication

Setup

1. Go to Google Cloud Console (https://console.cloud.google.com/)
2. Create a new project or select existing
3. Enable Gmail API from API Library
4. Create OAuth 2.0 credentials:
   • Go to "Credentials" → "Create Credentials" → "OAuth client ID"
   • Application type: "Desktop app"
   • Download the JSON and get client_id and client_secret
5. Configure environment variables

Environment Variables

Variable	Required	Description
GMAIL_CLIENT_ID	Yes	OAuth Client ID from Google Cloud
GMAIL_CLIENT_SECRET	Yes	OAuth Client Secret

Usage Examples

Send an email to [e-mail] with subject "Project Update" and body "The project is complete"

List my recent emails from Gmail

Create a new label named "Projects/OpenClaw"

Message Types

• Plain text emails
• HTML emails (coming soon)
• Emails with attachments (coming soon)

Rate Limits

Google Gmail API has rate limits:

• 100:00 requests per day
• 100 requests per second

Troubleshooting

• "Invalid credentials": Re-check your OAuth credentials
• "Rate limit exceeded": Wait before making more requests
• "Account not verified": Your app needs to go through Google's verification for sensitive scopes