Google Keep

• Analyzed: May 13, 2026, 3:01 AM
• Findings: 1
• Version: 1.0.3
• Hash: 62ed7c5be3a10e70399314b472db8deadd1c756c49ff7eeda1ce51d62ffb75d6
• Source: palm
• External report: View on VirusTotal

Findings (1)

The OpenClaw skill bundle for Google Keep is benign. It provides a CLI wrapper for managing Google Keep notes using the `gkeepapi` library. The `SKILL.md` instructions are clear and do not contain any prompt injection attempts. The `gkeep.py` script handles Google Keep authentication tokens responsibly by storing them in `~/.config/gkeep/token.json` with restrictive file permissions (0o600). The `package.json`'s `postinstall` script performs a standard Python virtual environment setup and dependency installation from `requirements.txt`, which only lists the legitimate `gkeepapi` library. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, or obfuscation.