Google Keep notes via gkeepapi. List, search, create, and manage notes.

This skill appears to do what it says: a CLI wrapper around gkeepapi that stores a local token in ~/.config/gkeep/token.json. Before installing or running it: 1) Verify you trust the package source (the repo homepage is provided). 2) Prefer using a Google App Password as recommended; avoid placing your account password in environment variables. 3) Note the bundle includes package.json with a postinstall script — running npm install or package postinstall will execute commands to create a venv and install Python dependencies, so only do that from a trusted source. 4) Inspect or backup the token file and consider revoking the app password/token in your Google account if you stop using the skill. 5) Small inconsistencies (venv path and package bin name) look like packaging/documentation issues rather than malicious behavior, but confirm install/run steps match how you plan to use it.

Type: OpenClaw Skill Name: gkeep Version: 1.0.3 The OpenClaw skill bundle for Google Keep is benign. It provides a CLI wrapper for managing Google Keep notes using the `gkeepapi` library. The `SKILL.md` instructions are clear and do not contain any prompt injection attempts. The `gkeep.py` script handles Google Keep authentication tokens responsibly by storing them in `~/.config/gkeep/token.json` with restrictive file permissions (0o600). The `package.json`'s `postinstall` script performs a standard Python virtual environment setup and dependency installation from `requirements.txt`, which only lists the legitimate `gkeepapi` library. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, or obfuscation.