google-workspace
Integrates Google Workspace services like Gmail, Calendar, and Drive through a CLI or Python for seamless productivity.
Install this skill
or
63/100
Security score
The google-workspace skill was audited on May 17, 2026 and we found 13 security issues across 3 threat categories. Review the findings below before installing.
Categories Tested
Security Issues
medium line 40
Template literal with variable interpolation in command context
SourceSKILL.md
| 40 | ```bash |
medium line 171
Template literal with variable interpolation in command context
SourceSKILL.md
| 171 | ```bash |
medium line 128
Access to hidden dotfiles in home directory
SourceSKILL.md
| 128 | `~/.hermes/google_oauth_last_url.txt`. |
medium line 162
Access to hidden dotfiles in home directory
SourceSKILL.md
| 162 | - Token is stored at `~/.hermes/google_token.json` and auto-refreshes. |
medium line 163
Access to hidden dotfiles in home directory
SourceSKILL.md
| 163 | - Pending OAuth session state/verifier are stored temporarily at `~/.hermes/google_oauth_pending.json` until exchange completes. |
medium line 164
Access to hidden dotfiles in home directory
SourceSKILL.md
| 164 | - If `gws` is installed, `google_api.py` points it at the same `~/.hermes/google_token.json` credentials file. Users do not need to run a separate `gws auth login` flow. |
low line 89
External URL reference
SourceSKILL.md
| 89 | > https://console.cloud.google.com/projectselector2/home/dashboard |
low line 91
External URL reference
SourceSKILL.md
| 91 | > https://console.cloud.google.com/apis/library |
low line 95
External URL reference
SourceSKILL.md
| 95 | > https://console.cloud.google.com/apis/credentials |
low line 99
External URL reference
SourceSKILL.md
| 99 | > https://console.cloud.google.com/auth/audience |
low line 132
External URL reference
SourceSKILL.md
| 132 | - Tell the user that the browser will likely fail on `http://localhost:1` after approval, and that this is expected. |
low line 134
External URL reference
SourceSKILL.md
| 134 | - If the user gets `Error 403: access_denied`, send them directly to `https://console.cloud.google.com/auth/audience` to add themselves as a test user. |
low line 138
External URL reference
SourceSKILL.md
| 138 | The user will paste back either a URL like `http://localhost:1/?code=4/0A...&scope=...` |
Scanned on May 17, 2026
View Security DashboardGitHub Stars 153.5K
Rate this skill
Categorysales
UpdatedMay 20, 2026
openclawapicustomer-success-managersupport-agenttechnical-supportoperations-managerhr-generalistgmailgoogle-docsgoogle-sheetssalessupportoperationshr
NousResearch/hermes-agent