google-workspace
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
subprocessto interact with system tools and an optional external CLI. - In
scripts/setup.py,subprocess.check_callis used to install required Python dependencies (google-api-python-client, etc.) viapip. - In
scripts/google_api.py,subprocess.runis used to execute thegwsCLI if it is installed on the user's system to perform Google Workspace operations. - In
scripts/gws_bridge.py,subprocess.runexecutes thegwsCLI after ensuring the OAuth2 token is refreshed. - [DATA_EXPOSURE]: The skill manages sensitive OAuth2 credentials (client secrets and access tokens).
- It explicitly defines paths for these files (e.g.,
~/.hermes/google_token.json) and includes instructions for the user to download and provide their own client secrets from the Google Cloud Console. - The script
scripts/setup.pyincludes a--revokecommand to delete these local credentials. - [EXTERNAL_DOWNLOADS]: The skill downloads official Python libraries from standard registries.
scripts/setup.pyfacilitates the installation ofgoogle-api-python-client,google-auth-oauthlib, andgoogle-auth-httplib2from PyPI.
Audit Metadata