← 返回 Skills 市场
tag-assistant

Google Keep

作者 Tag · GitHub ↗ · v1.0.0
cross-platform ⚠ suspicious
736
总下载
0
收藏
1
当前安装
1
版本数
在 OpenClaw 中安装
/install google-keep
功能描述
Read, create, edit, search, and manage Google Keep notes and lists via CLI.
使用说明 (SKILL.md)

Google Keep CLI Skill

Manage Google Keep notes and lists from the command line using the unofficial gkeepapi.

Setup

After installing, the CLI lives in the skill directory. Set up a convenience alias or wrapper:

SKILL_DIR="\x3Cpath-to-this-skill>"  # e.g. skills/google-keep
alias gkeep="$SKILL_DIR/.venv/bin/python3 $SKILL_DIR/gkeep.py"

Or create a global wrapper:

cat > ~/.local/bin/gkeep \x3C\x3C 'EOF'
#!/bin/bash
SKILL_DIR="$(dirname "$(readlink -f "$0")")/../.openclaw/workspace/skills/google-keep"
exec "$SKILL_DIR/.venv/bin/python3" "$SKILL_DIR/gkeep.py" "$@"
EOF
chmod +x ~/.local/bin/gkeep

Authentication

First-time setup (OAuth token exchange):

  1. Go to https://accounts.google.com/EmbeddedSetup in your browser
  2. Log in with your Google account
  3. Click "I agree" on the consent screen (page may spin forever — ignore it)
  4. Open DevTools: F12 → Application tab → Cookies → accounts.google.com
  5. Copy the value of the oauth_token cookie
  6. Run:
gkeep auth \x3Cemail> \x3Coauth_token>

With pre-obtained master token:

gkeep auth-master \x3Cemail> \x3Cmaster_token>

Credentials are stored in \x3Cskill-dir>/.config/ (chmod 600). The master token has full account access — treat it like a password. It does not expire (unlike standard OAuth refresh tokens).

Commands

List notes

gkeep list                    # Active notes
gkeep list --archived         # Include archived
gkeep list --pinned           # Pinned only
gkeep list --label "Shopping" # Filter by label
gkeep list --json             # JSON output
gkeep list -v                 # Show IDs

Search

gkeep search "grocery"
gkeep search "todo" --json

Get a specific note

gkeep get \x3Cnote-id>
gkeep get "Shopping List"     # By title (case-insensitive)
gkeep get \x3Cid> --json

Create notes

gkeep create --title "Ideas" --text "Some thoughts"
gkeep create --title "Groceries" --list --items "Milk" "Eggs" "Bread"
gkeep create --title "Important" --pin --color Red --label "Work"

Edit notes

gkeep edit \x3Cid-or-title> --title "New Title"
gkeep edit \x3Cid-or-title> --text "Updated text"
gkeep edit \x3Cid-or-title> --pin true
gkeep edit \x3Cid-or-title> --archive true
gkeep edit \x3Cid-or-title> --color Blue

List operations

gkeep check "Groceries" "milk"           # Check off an item
gkeep check "Groceries" "milk" --uncheck # Uncheck
gkeep check "Groceries" "m" --all        # Check all matching
gkeep add-item "Groceries" "Butter" "Cheese"  # Add items

Delete (trash)

gkeep delete \x3Cid-or-title>

Labels

gkeep labels              # List all labels
gkeep labels --json

Export / backup

gkeep dump                # All notes as JSON
gkeep dump > backup.json

Colors

Valid colors: White, Red, Orange, Yellow, Green, Teal, Blue, DarkBlue, Purple, Pink, Brown, Gray

How it works

  • Uses gkeepapi (1,600+ stars, actively maintained) — an unofficial reverse-engineered Google Keep client
  • Auth via gpsoauth — Google Play Services OAuth flow to obtain a master token
  • State is cached locally (.config/state.json) for fast startup after the initial sync
  • Master tokens don't expire, so no re-auth dance
  • Unofficial API — Google could break compatibility at any time (but gkeepapi has been stable for years)

Security notes

  • The master token grants full access to the associated Google account
  • Credentials are stored with 600 permissions in .config/
  • Never commit .config/ to version control
  • delete moves notes to trash (recoverable) — it does not permanently delete
安全使用建议
This skill is coherent for a Google Keep CLI wrapper, but take these precautions before installing: 1) The master token the tool uses is long‑lived and grants full account access — treat it like a password and keep the .config/ directory private (SKILL.md and code set 600 perms). 2) SKILL.md asks you to copy an 'oauth_token' cookie from your browser DevTools to perform the token exchange; that is a manual, error‑prone step — only copy tokens from a browser you trust and avoid pasting them into other places. 3) The install uses 'uv' to create a venv and pip to install gkeepapi and gpsoauth; verify these packages and their versions (and the maintainers) if you have policies about third‑party libs. 4) The code stores token and state locally and prints some responses on error — avoid running this as root or from privileged contexts. 5) I saw the provided gkeep.py file but it was truncated in the data you gave; review the full source locally before trusting it. If you need stronger assurance, prefer using an official Google API + OAuth flow rather than an unofficial reverse‑engineered client that requires a master token.
功能分析
Type: OpenClaw Skill Name: google-keep Version: 1.0.0 The skill is classified as suspicious due to its handling of Google account credentials. It stores a non-expiring 'master token' (obtained via `gpsoauth`) that grants 'full account access' to the associated Google account in a local file (`.config/master_token`). While the skill explicitly warns the user about this risk in `SKILL.md` and sets file permissions to `0o600` in `gkeep.py`, the inherent design choice to store such a powerful, persistent credential locally represents a significant vulnerability. If the skill's directory or the user's system is compromised, this token could be stolen and used indefinitely, posing a high risk. There is no evidence of malicious intent or unauthorized data exfiltration beyond the stated purpose of managing Google Keep notes.
能力评估
Purpose & Capability
Name/description (Google Keep CLI) align with the files and dependencies: gkeepapi and gpsoauth are expected for an unofficial Google Keep client. The requested binaries (python3 and 'uv') match the SKILL.md install steps (uv used to create the venv). Nothing else (no unrelated cloud creds, no unrelated binaries) is requested.
Instruction Scope
Runtime instructions and the CLI implementation stay within the stated purpose (auth, list, search, create, edit, delete, dump). The SKILL.md instructs a manual cookie extraction from browser DevTools (copy accounts.google.com 'oauth_token' cookie) to do the OAuth exchange — this is unusual and requires user care. The skill reads/writes its own local config (.config/ by default) but does not attempt to read other system credentials or other paths.
Install Mechanism
No remote download of arbitrary code or obscure URLs. Install uses a local virtualenv (uv venv .venv) and pip to install two public libraries (gkeepapi and gpsoauth) from PyPI — a reasonable, traceable approach. The 'uv' binary requirement is needed by the provided install command and may be unexpected for some users but is not inherently suspicious.
Credentials
No required environment variables or unrelated credentials. The code uses an optional GKEEP_CONFIG_DIR env var to override where tokens/state are stored — acceptable and documented. The master token is stored in a local file with 600 perms; the skill documents that the master token grants full account access.
Persistence & Privilege
always:false and no attempt to modify other skills or system-wide agent configuration. The skill persists its own token and state in its config directory (expected for a CLI client). It does not request permanent platform-level privileges.
如何使用
  1. 确保已安装 OpenClaw(本地或 Docker 部署)
  2. 在对话框中输入安装命令:/install google-keep
  3. 安装完成后,直接呼叫该 Skill 的名称或使用 /google-keep 触发
  4. 根据 Skill 的参数说明提供必要输入,即可获得结构化输出
版本历史
v1.0.0
Initial release: Manage Google Keep notes and lists via the command line. - Read, create, search, edit, and delete Google Keep notes and checklists using CLI commands. - Authenticate with Google using oauth_token or master token; credentials stored securely. - Supports filtering, archiving, pinning, labeling, color, and exporting notes to JSON. - Bulk list and item management, including check/uncheck and label operations. - Uses unofficial gkeepapi and gpsoauth for backend functionality. - Credentials and state cached locally for convenience and performance.
元数据
Slug google-keep
版本 1.0.0
许可证
累计安装 1
当前安装数 1
历史版本数 1
常见问题

Google Keep 是什么?

Read, create, edit, search, and manage Google Keep notes and lists via CLI. 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件,目前累计下载 736 次。

如何安装 Google Keep?

在 OpenClaw 或 Claude Code 对话框中运行命令「/install google-keep」即可一键安装,无需额外配置。

Google Keep 是免费的吗?

是的,Google Keep 完全免费(开源免费),可自由下载、安装和使用。

Google Keep 支持哪些平台?

Google Keep 跨平台运行,可在任意部署了 OpenClaw / Claude Code 的环境中使用(cross-platform)。

谁开发了 Google Keep?

由 Tag(@tag-assistant)开发并维护,当前版本 v1.0.0。

💬 留言讨论