google-bigquery
Pass
Audited by Gen Agent Trust Hub on Jun 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
npxto download and execute the@useclawlink/clipackage from the public npm registry. This is a standard mechanism for utilizing the vendor's provided tooling. - [COMMAND_EXECUTION]: The instructions guide the agent to perform actions by executing shell commands. The skill explicitly advises the agent to confirm with the user before performing any write operations.
- [CREDENTIALS_UNSAFE]: Authentication is handled via a browser login flow, and credentials (OAuth tokens) are stored locally at
~/.clawlink/credentials.json. This follows standard security practices for CLI-based tools to avoid hardcoding secrets in code or prompts.
Audit Metadata