Google Keep

Google Keep notes via gkeepapi. List, search, create, and manage notes.

Security Scan

The skill is internally consistent with a CLI wrapper for gkeepapi — it functions as described, requests no unrelated credentials, and stores a local token — but there are a few small mismatches you should be aware of before installing.

Purpose & Capability

Name, description, and the provided Python CLI (gkeep.py) implement Google Keep operations via gkeepapi (list, search, create, archive, delete, pin, etc.). Required binaries list includes 'gkeep', which matches the CLI provided. No unrelated services or credentials are requested.

Instruction Scope

SKILL.md stays on-purpose (login, list, search, create, manage notes). It documents the use of an app password and that tokens are stored at ~/.config/gkeep/token.json. Minor mismatch: SKILL.md says first run bootstraps a venv at 'skills/gkeep/.venv' but package.json/postinstall would create '.venv' in the package directory — the runtime code itself does not reference that venv path. No instructions ask to read or exfiltrate unrelated files.

Install Mechanism

There is no explicit install spec provided to the platform (instruction-only), which is low-risk. However, the bundle includes a package.json with a postinstall script that will create a Python venv and pip-install requirements if an npm install were run. That postinstall is not executed by the platform by default but is important to notice if you manually install via npm or run package scripts.

Credentials

The skill declares no required environment variables, which is appropriate. The code does read an optional GKEEP_PASSWORD env var during login (fallback to interactive prompt) but this env var is not declared in metadata — benign but a minor documentation gap. Tokens (keep.getMasterToken()) are saved to ~/.config/gkeep/token.json with 0o600 permissions per the code, which is expected for local credential storage.

Persistence & Privilege

always:false and normal invocation settings. The skill persists a token in the user's home config directory (expected for a CLI client) and may create a local venv when installed/run; it does not request system-wide privileges or modify other skills.

Assessment

This skill appears to do what it says: a CLI wrapper around gkeepapi that stores a local token in ~/.config/gkeep/token.json. Before installing or running it: 1) Verify you trust the package source (the repo homepage is provided). 2) Prefer using a Google App Password as recommended; avoid placing your account password in environment variables. 3) Note the bundle includes package.json with a postinstall script — running npm install or package postinstall will execute commands to create a venv and install Python dependencies, so only do that from a trusted source. 4) Inspect or backup the token file and consider revoking the app password/token in your Google account if you stop using the skill. 5) Small inconsistencies (venv path and package bin name) look like packaging/documentation issues rather than malicious behavior, but confirm install/run steps match how you plan to use it.

gkeep

CLI wrapper for Google Keep using gkeepapi (unofficial API).

Setup

Login with your Google account:

gkeep login [e-mail]

Important: Use an App Password, not your regular password. 2FA must be enabled.

Commands

List notes:

gkeep list
gkeep list --limit 10

Search:

gkeep search "shopping"

Get a specific note:

gkeep get <note_id>

Create a note:

gkeep create "Title" "Body text here"

Archive:

gkeep archive <note_id>

Delete (trash):

gkeep delete <note_id>

Pin:

gkeep pin <note_id>

Unpin:

gkeep unpin <note_id>

Notes

• This uses an unofficial API that reverse-engineers Google Keep
• Could break if Google changes their internal API
• Token stored in ~/.config/gkeep/token.json
• First run bootstraps a local venv at skills/gkeep/.venv
• Active project with recent updates (as of Jan 2026)