Google Workspace

Gmail, Contacts, Calendar, Drive (with comments), Docs, and Sheets for OpenClaw agents

This skill appears to implement exactly what it advertises: a Google Workspace CLI that uses OAuth and encrypts the refresh token with a provided key. Before installing: 1) Confirm you created the OAuth Desktop client in your Google Cloud project and only provide the CLIENT_ID/SECRET to this instance; 2) Provide GOOGLE_WORKSPACE_TOKEN_KEY from a secure secret store so the token at rest is encrypted; 3) If you want maximum assurance, either verify the release checksums in dist/checksums.txt or build the binary from source yourself (go build); 4) Keep Docs/Sheets/Drive in 'off' or 'readonly' unless you deliberately enable readwrite — the binary warns that readwrite requires broad Drive scopes; 5) Note the repo/publish metadata mismatch (no formal install spec in registry) — if you rely on automatic installers, verify how clawhub will obtain and install the binary. If any of these points are unacceptable or unclear, do not install until resolved.

Type: OpenClaw Skill Name: panthrocorp-google-workspace Version: 0.5.2 The Google Workspace skill is a well-architected and security-focused integration for Gmail, Calendar, Contacts, Drive, Docs, and Sheets. It implements multiple layers of defense, including hardcoded read-only access for sensitive services (Gmail/Contacts), configuration-gated write operations for others, and AES-256-GCM encryption for stored OAuth tokens using a user-provided key (GOOGLE_WORKSPACE_TOKEN_KEY). The code (cmd/ and internal/google/) strictly follows the stated security boundaries, and no evidence of data exfiltration or malicious intent was found.