← 返回 Skills 市场

Andrew Google Tasks

Name: Andrew Google Tasks
Author: ibluewind

作者 김현곤 · GitHub ↗ · v1.0.0 · MIT-0

cross-platform ⚠ suspicious

总下载

当前安装

版本数

在 OpenClaw 中安装

/install andrew-google-tasks

功能描述

Google Tasks API �� (Task) �리. OAuth 2.0 �� . �� 목�� 조�, ��, ��, �� 리�� .

使用说明 (SKILL.md)

Google Tasks

Overview

Google Tasks API 를 �� (Tasks) � 조�, ��, ��, �� 리�� . OAuth 2.0 �� Tasks � �근��.

Setup

1. OAuth ��

�미 구� �린�, �� 과 �� :

# �� ��� �미 ���� ��면 ��
ls ~/.google-credentials.json

2. �존� ��

pip install google-api-python-client google-auth-httplib2 google-auth-oauthlib

3. ��

cd /Users/andrew/.openclaw/workspace/google-tasks
python3 scripts/tasks_ops.py

첫 �� 리고 Google �� 그� � �� .

Capabilities

�� 목� 조�

�� 목� ��:

"� �� � 목� 보��"
"�� �� �� �� �� ��?"

� ��

� �� :

"�� 미� ���� � �����, ��� �� �� 2 �"
"����� 보고�를 ����� ��, �모: 5 ��� ��"

�� 리

�� :

"�� 미� �� ��� �����"

��

�� 경:

"����� 보고� ���� �� 주 ���� ���"

��

�� 취�:

"���� �� �����"

Usage Examples

�� 1: �� 목� 조�

from scripts.tasks_ops import list_tasks, format_task

# 기본 목�� �� 조�
tasks = list_tasks('@default')
for task in tasks:
    print(format_task(task))

�� 2: � ��

from scripts.tasks_ops import create_task

# � �� ��
task = create_task(
    tasklist_id='@default',
    title='����� 보고� ��',
    notes='5 ��� ��, �����',
    due='2026-04-20T17:00:00+09:00'
)
print(f"�� �� ��: {task['title']}")

�� 3: �� 리

from scripts.tasks_ops import complete_task

# �� ��
task_id = '��_ID_�기�'
complete_task('@default', task_id)
print("�� �� �리�!")

�� 4: �� 목� 목� 조�

from scripts.tasks_ops import list_tasklists

tasklists = list_tasklists()
for tl in tasklists:
    print(f"{tl['title']} - {tl['id']}")

Files Structure

google-tasks/
��� SKILL.md
��� scripts/
    ��� tasks_ops.py      # Tasks API �� ����

Security Notes

OAuth �� ~/.google-tasks-token.pickle � ��
�� ~/.google-credentials.json � �� (�린�, �� 과 공�)
� �� .gitignore � ��
�� : https://www.googleapis.com/auth/tasks (Tasks �체 �근)

Troubleshooting

"OAuth �� " ��:

~/.google-credentials.json ��
구� �린� �� 미 ��

�� :

�� 고 ��: rm ~/.google-tasks-token.pickle

�� :

�� : rm ~/.google-tasks-token.pickle && python3 scripts/tasks_ops.py

Integration with Other Google Skills

Same OAuth credentials (~/.google-credentials.json) are shared with google-calendar and google-sheets skills, so you only need to authenticate once!

安全使用建议

This skill appears to be a normal Google Tasks client. Before installing: (1) confirm the ~/.google-credentials.json file you supply is a Google OAuth client secret you created in the Google Cloud Console; (2) be aware the skill will open a local OAuth consent flow (runs a local web server on port 8083) and will write an OAuth token to ~/.google-tasks-token.pickle; (3) avoid reusing overly-broad OAuth credentials across unrelated skills unless you intend to grant them the same access; (4) the skill's source/publisher is unknown and the README uses a hard-coded user path (/Users/andrew/...), so for extra caution inspect the included scripts yourself before running them and install pip packages from a trusted environment. If you want higher assurance, ask the publisher for provenance or a reputable homepage/repo before granting credentials.

功能分析

Type: OpenClaw Skill Name: andrew-google-tasks Version: 1.0.0 The skill provides legitimate Google Tasks management functionality but contains a security vulnerability in 'scripts/tasks_ops.py' by using the 'pickle' module to load authentication tokens from the user's home directory ('~/.google-tasks-token.pickle'). This is a known risk for Remote Code Execution (RCE) if the local token file is tampered with. Additionally, 'SKILL.md' contains hardcoded environment-specific paths and assumes shared credentials with other Google skills, which increases the potential impact of a credential compromise.

能力标签

requires-oauth-tokenrequires-sensitive-credentials

能力评估

✓ Purpose & Capability

Name/description match the included code and instructions: the package implements Google Tasks operations (list, create, update, complete, delete) using google-api-python-client and OAuth. Required credentials are stored as an OAuth client JSON and a token file in the user's home directory, which is appropriate for this purpose.

ℹ Instruction Scope

SKILL.md only instructs installing Google client libs, ensuring ~/.google-credentials.json exists, and running the provided script. It references the token file (~/.google-tasks-token.pickle) and runs a local OAuth server (port 8083). A minor oddity: example run path uses a hard-coded user directory (/Users/andrew/...), which is a documentation artifact but not harmful. No instructions ask the agent to read unrelated system files or transmit data to non-Google endpoints.

✓ Install Mechanism

There is no install spec; the SKILL.md suggests pip installing standard google-auth packages. No external binary downloads or untrusted URLs are used. This is low-risk installation behavior, though pip installs come from PyPI (supply-chain considerations apply).

✓ Credentials

No environment variables or unrelated credentials are requested. The script requires an OAuth client secret JSON in the user's home directory and stores an OAuth token pickle there; the requested OAuth scope is only https://www.googleapis.com/auth/tasks, which matches the skill's functionality.

ℹ Persistence & Privilege

The skill does persist an OAuth token to ~/.google-tasks-token.pickle (normal for installed Google clients). always is false and the skill does not modify other skills' configuration. Note that the SKILL.md suggests sharing the same client credentials across other Google skills, which increases cross-skill access if you reuse the same OAuth client.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install andrew-google-tasks
安装完成后，直接呼叫该 Skill 的名称或使用 /andrew-google-tasks 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v1.0.0

andrew-google-tasks 1.0.0 - Initial release with Google Tasks API integration. - Supports creating, listing, updating, completing, and deleting tasks. - OAuth 2.0 based authentication. - Korean documentation and usage examples included. - Shares OAuth credentials with other Google skills for unified authentication.

元数据

Slug andrew-google-tasks

版本 1.0.0

许可证 MIT-0

累计安装 1

当前安装数 1

历史版本数 1

常见问题