google-workspace-cli

SUSPICIOUS. The operational scope fits a Google Workspace admin skill, and data flows appear directed to Google APIs, but the install instructions are not internally consistent with the claimed project: the skill mixes an Anthropic npm package with a Google Workspace GitHub repo and an incorrect Cargo package name. That is a trust and provenance issue rather than confirmed malware.

This module is primarily a command orchestration catalog for Google Workspace-related CLI operations. It shows no overt malware indicators (no credential theft, exfiltration, persistence, or obfuscation) in the provided fragment. However, it contains a high-impact structural risk: it executes shell command strings via subprocess.run(..., shell=True) sourced from a recipe catalog. If the catalog or missing surrounding code performs placeholder interpolation or can be tampered with, the tool could become an arbitrary command execution vector. Treat as security-sensitive, especially in a supply-chain threat model.