google-classroom

SUSPICIOUS. The skill's purpose matches Google Classroom automation, and the CLI provenance appears same-brand and npm-distributed, but the data flow is mediated by ClawLink rather than direct Google APIs. That intermediary architecture, combined with stored local credentials, unpinned npx execution, and write/delete capabilities, creates medium-to-high security risk even without clear evidence of malware.