Dialogflow Cx Advanced
PassAudited by ClawScan on May 10, 2026.
Overview
This is a coherent Dialogflow CX management helper, but it needs Google Cloud credentials and includes user-directed operations that can change environments, webhooks, and deployments.
Install only if you intend to manage Dialogflow CX resources. Use limited Google Cloud credentials, verify all project and agent IDs, review any create/deploy webhook operation before running it, and only point webhooks at trusted HTTPS endpoints.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If used with broad Google Cloud credentials, the agent could read or change Dialogflow CX resources allowed by those credentials.
The skill requires Google Cloud identity material to access Dialogflow CX. This is expected for the stated purpose, but it grants account-level authority within the selected project and agent.
- Service account or OAuth credentials with Dialogflow API access - `gcloud` CLI authenticated OR bearer token
Use a least-privileged service account or token limited to the intended project, location, and agent, and avoid sharing raw bearer tokens in chat unless necessary.
Mistaken or overbroad use could create production environments or webhook integrations in the wrong Dialogflow CX agent.
The skill documents direct REST calls that create Dialogflow CX environments and webhooks. These are purpose-aligned administrative actions, but they can modify live cloud configuration.
### Create Environment ```bash curl -X POST ... /environments ... ``` ... ### Create Webhook ```bash curl -X POST ... /webhooks ...
Confirm project, location, agent, and target environment before any POST or deployment operation, and prefer staging or dry-run review where available.
Conversation content and session parameters may be sent to the webhook server you configure.
The reference explains that configured webhooks receive conversation text and session parameters. This is normal for Dialogflow fulfillment, but it creates a sensitive data flow to the configured webhook endpoint.
"genericWebService": {
"uri": "https://your-webhook.com/fulfill"
}
...
"sessionInfo": { "parameters": { ... } },
"text": "user input"Only configure trusted webhook URLs, use HTTPS and appropriate authentication, and avoid sending sensitive session parameters unless required.
Future package versions or a compromised local Python environment could affect the helper script's behavior.
The helper script instructs users to install external Python packages without pinned versions. This is common for a small CLI helper, but it leaves dependency provenance and version selection to the user environment.
Install:
pip install google-cloud-dialogflow-cx google-authInstall dependencies in a virtual environment and pin trusted package versions if using this in production workflows.