google-workspace

Pass

Audited by Gen Agent Trust Hub on Sep 5, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses subprocess to interact with system tools and an optional external CLI.
  • In scripts/setup.py, subprocess.check_call is used to install required Python dependencies (google-api-python-client, etc.) via pip.
  • In scripts/google_api.py, subprocess.run is used to execute the gws CLI if it is installed on the user's system to perform Google Workspace operations.
  • In scripts/gws_bridge.py, subprocess.run executes the gws CLI after ensuring the OAuth2 token is refreshed.
  • [DATA_EXPOSURE]: The skill manages sensitive OAuth2 credentials (client secrets and access tokens).
  • It explicitly defines paths for these files (e.g., ~/.hermes/google_token.json) and includes instructions for the user to download and provide their own client secrets from the Google Cloud Console.
  • The script scripts/setup.py includes a --revoke command to delete these local credentials.
  • [EXTERNAL_DOWNLOADS]: The skill downloads official Python libraries from standard registries.
  • scripts/setup.py facilitates the installation of google-api-python-client, google-auth-oauthlib, and google-auth-httplib2 from PyPI.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 5, 2026, 12:07 PM