Google Keep
ReviewAudited by ClawScan on May 1, 2026.
Overview
This skill appears to do what it says—manage Google Keep notes—but it needs Google account token access and can change or trash notes.
Install this only if you trust it with your Google Keep notes. Use an App Password, keep the token file private, review note-changing actions before they run, and revoke/delete the saved token if access is no longer needed.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Anyone who can use the saved token through this skill may be able to read and modify the user's Google Keep notes.
The skill authenticates to a Google account and saves a reusable token. This is necessary for Google Keep access, but it is sensitive account authority.
password = os.environ.get("GKEEP_PASSWORD") or getpass.getpass("Password (or app password): ") ... "token": keep.getMasterToken()Use a Google App Password as instructed, protect the local token file, and revoke the app password or delete ~/.config/gkeep/token.json if you no longer want the skill to access Keep.
An accidental or poorly reviewed command could create, archive, trash, pin, unpin, or edit Google Keep notes.
The documented tool surface includes commands that change cloud notes. This matches the stated purpose, but users should notice the mutation authority.
Create a note: `gkeep create "Title" "Body text here"` ... Archive: `gkeep archive <note_id>` ... Delete (trash): `gkeep delete <note_id>`
Confirm note IDs and intended changes before allowing archive, delete, add, check, pin, or unpin operations.
Dependency updates could change behavior or break the unofficial Google Keep integration.
The skill relies on an external third-party package with a lower-bound version rather than a pinned exact version. This is common for small CLI tools but means future installs may resolve different package code.
gkeepapi>=0.14.0
Prefer installing from a trusted source and consider pinning or locking the gkeepapi dependency version.