Design Gmail, Drive, Sheets, and Calendar automations with scope-aware plans. Use for repeatable daily task automation with explicit OAuth scopes and audit-r...

This skill appears to be a planning-only tool: it generates automation plans and OAuth-scope lists from a JSON input and writes an output file. Before using it, review the output path you provide (to avoid overwriting important files), inspect any input JSON for sensitive data, and remember this tool does not perform API actions—if you later implement the plan against Google Workspace you will need to supply and protect OAuth credentials separately. If you want the skill to actually execute automations, require and audit OAuth usage at that time.

Type: OpenClaw Skill Name: google-workspace-automation Version: 0.1.0 The `scripts/plan_workspace_automation.py` script is suspicious due to potential arbitrary file read and write vulnerabilities. It accepts an `--input` path, allowing it to read any file accessible to the agent, leading to information disclosure. It also accepts an `--output` path, allowing it to write the generated automation plan to arbitrary locations, which could overwrite sensitive files. While the script's core functionality is legitimate (planning automation), these capabilities, if exploited by an attacker controlling the arguments, pose significant risks without clear malicious intent within the script itself.