← Back to Skills Marketplace
19255
Downloads
21
Stars
0
Active Installs
20
Versions
Install in OpenClaw
/install google-workspace-admin
Description
Google Workspace Admin SDK integration with managed OAuth. This is a write-capable administrative integration for users, groups, organizational units, roles, and domain settings. Only connect with a least-privileged Google admin account, restrict OAuth scopes to the specific resources needed, and revoke the connection after use. All write operations require explicit user approval showing the exact HTTP method, endpoint path, and target resource identifier before execution. Use this skill only when users need Google Workspace administration. For other third party apps, use the api-gateway skill (https://clawhub.ai/byungkyu/api-gateway). Calls run through the `maton` CLI with OAuth login, or over raw HTTP with a Maton API key where the CLI cannot be installed. Every call is authenticated as the user's connection and reaches only what that connection's authorization allows, which the provider enforces on every request; the endpoints documented here are the ones this skill uses, and any other endpoint of this app needs the user to ask for it by name. Default to read and list calls, and confirm every write or new connection with the user. This file also documents the three constructs that turn a Google Workspace Admin connection into automation, in the order they are used: the connection (the first step), a hosted function that runs a Google Workspace Admin action through the Maton SDK, and a trigger that calls that function on a schedule or on an event. Those sections are the platform's own reference text, shared with the api-gateway skill, with Google Workspace Admin examples; they add no Google Workspace Admin capability - Google Workspace Admin is not an event source, a trigger cannot read Google Workspace Admin data, and the files under `references/<source>/triggers.md` are the platform's event catalogues for the sources Maton offers (time, Calendly, GitHub, Gmail, HubSpot, Linear, Notion, Slack, Stripe).
Usage Guidance
Install only if you intend to let an agent help administer Google Workspace. Use a least-privileged admin account, review every write operation carefully, avoid broad triggers or third-party destinations unless you explicitly need them, and revoke Maton/Google connections when the task is complete.
Capability Assessment
Credentials
Network access, OAuth, and Maton account use are necessary for the integration; raw HTTP with a Maton API key is documented only as a fallback with handling warnings.
Install Mechanism
Installation uses pinned Maton CLI/SDK versions via npm, Homebrew, or documented SDK packages; the skill package itself contains Markdown references and no executable scripts.
Instruction Scope
Instructions default to read/list calls, require exact user confirmation before writes or connection creation, and explicitly scope functions, triggers, destinations, and local execution.
Persistence & Privilege
OAuth tokens, hosted functions, triggers, and trigger destinations can persist, but the artifact discloses this and requires explicit user approval, least-privilege scoping, and cleanup or revocation guidance.
Purpose & Capability
The skill is intentionally write-capable for Google Workspace users, groups, org units, roles, and domain settings; those are high-impact admin actions, but they match the stated purpose and are repeatedly disclosed.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install google-workspace-admin - After installation, invoke the skill by name or use
/google-workspace-admin - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.2.10
Simplify the login instructions to the code flow (maton login prints a link; finish with maton login --code <CODE>), drop the API Key subsection, and pin the Maton CLI install to 0.4.0.
v1.2.9
Switch the login instructions to the device flow (maton login prints a link and a user code; the --oauth flag is gone) and pin the Maton CLI install to 0.3.5.
v1.2.8
Pin the Maton CLI install to 0.3.4, the current release.
v1.2.7
Add this skill's own trigger policy to the shared Triggers section: the only destination it sets up is its own hosted function inside the platform, it does not forward events to third-party hosts, and it does not use event watch --exec; each trigger reference now also says this skill configures no trigger from that source on its own.
v1.2.6
Bring the skill to the current api-gateway baseline and tell the connection-to-function-to-trigger story: the shared Functions and Triggers sections open with an example for this app (a hosted function that performs one action for it through the Maton SDK, and the trigger that runs it - its own event source where it has one, otherwise a time schedule), the description says these constructs turn the connection into automation and add no capability of their own, the passthrough is described by its enforced boundary, CLI and SDK installs are pinned to 0.3.1, absolute API URLs are placeholders, and multipart uploads use mktemp.
v1.2.5
Tell the connection-to-function-to-trigger story for this app: the Functions section opens with a function that performs one action for this app through the Maton SDK, the Triggers section opens with the trigger that runs it (this app's own event source where it has one, otherwise a time schedule), and the description says these are the constructs that turn the connection into automation and add no capability of their own. Framing is generated from a per-app record so the shared platform text stays identical to api-gateway.
v1.2.4
Correct the Functions text: the runtime-injected MATON_API_KEY is placed in the sandbox's environment only while the function runs, never stored in the package or code and never set through function env - the previous wording said it was never an environment variable, which contradicted the Handler/Environment section.
v1.2.3
Explain the platform sections this skill shares with api-gateway: why hosted functions and triggers are documented here, whether this app is an event source, that the trigger reference files are the platform's event catalogues and add no capability for this app, and that destinations forward source payloads rather than this app's records. Adds this skill's own policy: destinations stay on api.maton.ai or *.maton.app unless the user names and approves a third-party host, and functions set up during a task here are deployed with DENY_ALL networking. Each trigger reference opens with the same framing.
v1.2.2
Bring the skill to the current api-gateway baseline: API reference, Functions and trigger references mirrored from api-gateway 1.2.17; CLI and SDK installs pinned to 0.3.1; absolute API URLs replaced with placeholders; multipart uploads use mktemp; the passthrough is described by its enforced boundary (host pinning and the connection's authorization) rather than as a documented list that is not a technical limit; the native-API-docs tip no longer reads as a menu of further endpoints.
v1.2.1
The create-user example shipped a literal password value. It now takes a placeholder the user supplies, with a note that an invented password is a credential the agent then knows, that changePasswordAtNextLogin should stay true, and that the request body should not be printed back.
v1.2.0
CLI-first rewrite with the Maton SDK examples; clarify that the CLI and SDKs keep separate credential stores, and reword webhook egress warnings
v1.1.0
CLI-first rewrite: the maton CLI with OAuth login is the documented path, every example is a maton command, SDK examples added, and the raw HTTP fallback feeds the key on stdin instead of reading it from the environment
v1.0.7
- Stricter security: All write operations now require explicit user approval showing the exact HTTP method, endpoint path, and resource identifier before execution.
- Documentation clarified: Description, permissions, and security sections updated for greater emphasis on least-privileged access and connection targeting.
- API usage guidance improved: Users must always specify the `Maton-Connection` header to prevent misrouted admin requests.
- Endpoints restricted: Only documented API endpoints are supported; constructing arbitrary paths is no longer allowed.
- Warnings expanded: All high-impact actions must show detailed consequences and require user confirmation.
v1.0.6
- Updated documentation to emphasize the high-impact, write-capable nature of this integration.
- Added strong warnings to use least-privilege admin accounts and OAuth scopes, and to revoke connections when not needed.
- Clarified that all write operations (create, update, delete) require explicit user approval with specific resource identification and summary of consequences.
- Instructed users to confirm resource details via read operations before proceeding with any administrative change.
- Expanded guidance on security, permissions, and the irreversible impact of admin operations across the domain.
v1.0.5
- Changed all API endpoints from gateway.maton.ai and ctrl.maton.ai to api.maton.ai for a unified base URL.
- Updated connection management instructions to use api.maton.ai, including listing, creating, and deleting connections.
- Clarified security and permission details; emphasized explicit user approval before running write operations.
- Removed LICENSE.txt from the project files.
v1.0.4
- Added a homepage field (https://maton.ai) to the skill metadata.
- No changes to code or functionality.
v1.0.3
- Added new metadata fields under the "metadata" section for better skill description and requirements clarity.
- Introduced a "clawdbot" section specifying a required environment variable (MATON_API_KEY) and an emoji indicator.
- No core functionality changes; documentation and metadata improvements only.
v1.0.2
No changes detected in this release.
- Version number incremented to 1.0.2
- No file or documentation changes identified
v1.0.1
- Added a note to the description directing users to use the api-gateway skill for other third party apps.
- Replaced all bash/curl CLI examples with Python code snippets using urllib and os libraries.
- Updated authentication header examples to use the $MATON_API_KEY environment variable in shell snippets.
- No changes to the API or underlying functionality; documentation improvements only.
v1.0.0
Initial release of Google Workspace Admin SDK integration.
- Manage users, groups, organizational units, and domain settings via a unified API gateway.
- Supports managed OAuth authentication and multiple account connections.
- Includes detailed API reference and example curl commands for common user and group operations.
- Requires a Maton API key and offers tools to manage OAuth connections.
- Provides features such as user creation, group membership management, and organizational unit administration.
Metadata
Frequently Asked Questions
What is google-workspace-admin?
Google Workspace Admin SDK integration with managed OAuth. This is a write-capable administrative integration for users, groups, organizational units, roles, and domain settings. Only connect with a least-privileged Google admin account, restrict OAuth scopes to the specific resources needed, and revoke the connection after use. All write operations require explicit user approval showing the exact HTTP method, endpoint path, and target resource identifier before execution. Use this skill only when users need Google Workspace administration. For other third party apps, use the api-gateway skill (https://clawhub.ai/byungkyu/api-gateway). Calls run through the `maton` CLI with OAuth login, or over raw HTTP with a Maton API key where the CLI cannot be installed. Every call is authenticated as the user's connection and reaches only what that connection's authorization allows, which the provider enforces on every request; the endpoints documented here are the ones this skill uses, and any other endpoint of this app needs the user to ask for it by name. Default to read and list calls, and confirm every write or new connection with the user. This file also documents the three constructs that turn a Google Workspace Admin connection into automation, in the order they are used: the connection (the first step), a hosted function that runs a Google Workspace Admin action through the Maton SDK, and a trigger that calls that function on a schedule or on an event. Those sections are the platform's own reference text, shared with the api-gateway skill, with Google Workspace Admin examples; they add no Google Workspace Admin capability - Google Workspace Admin is not an event source, a trigger cannot read Google Workspace Admin data, and the files under `references/<source>/triggers.md` are the platform's event catalogues for the sources Maton offers (time, Calendly, GitHub, Gmail, HubSpot, Linear, Notion, Slack, Stripe). It is an AI Agent Skill for Claude Code / OpenClaw, with 19255 downloads so far.
How do I install google-workspace-admin?
Run "/install google-workspace-admin" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is google-workspace-admin free?
Yes, google-workspace-admin is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does google-workspace-admin support?
google-workspace-admin is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created google-workspace-admin?
It is built and maintained by byungkyu (@byungkyu); the current version is v1.2.10.
More Skills