google-workspace-cli

SUSPICIOUS: the skill’s purpose and capabilities are coherent for Google Workspace administration, but the install instructions are not. The mismatched npm and Cargo package names materially weaken install trust and could route users to the wrong package, while the rest of the data flows appear proportionate and aimed at official Google Workspace use rather than clear exfiltration.

This module is primarily a command orchestration catalog for Google Workspace-related CLI operations. It shows no overt malware indicators (no credential theft, exfiltration, persistence, or obfuscation) in the provided fragment. However, it contains a high-impact structural risk: it executes shell command strings via subprocess.run(..., shell=True) sourced from a recipe catalog. If the catalog or missing surrounding code performs placeholder interpolation or can be tampered with, the tool could become an arbitrary command execution vector. Treat as security-sensitive, especially in a supply-chain threat model.