by 安全扫描
OpenClaw
安全
high confidenceNULL
评估建议
This skill appears coherent, but it routes Google Workspace admin actions through a third-party (Maton). Before installing: verify you trust maton.ai (confirm owner identity and privacy/security docs), store MATON_API_KEY securely, and use least-privilege OAuth connections in Maton (only grant necessary admin scopes). Be aware that the MATON_API_KEY plus an active Maton connection allows administrative operations on your Workspace — consider testing in a non-production account, review connection...详细分析 ▾
✓ 用途与能力
The name and description claim a Google Workspace Admin SDK integration with managed OAuth. The SKILL.md shows calls to a Maton gateway (gateway.maton.ai) and a Maton control endpoint (ctrl.maton.ai) and requires MATON_API_KEY — this is coherent: the gateway performs OAuth and the API key is the expected credential. One minor note: registry metadata lists no homepage/source, while SKILL.md points to maton.ai; verify the owner identity if that matters to you.
✓ 指令范围
The instructions narrowly describe making HTTP requests to Maton endpoints, managing connections via ctrl.maton.ai, and using MATON_API_KEY and an optional Maton-Connection header. The SKILL.md does not instruct reading unrelated files, other credentials, or system paths, nor does it request data exfiltration. It does require network access (expected).
✓ 安装机制
No install spec and no code files (instruction-only). This minimizes disk/write/install risk; nothing is downloaded or executed on install.
✓ 凭证需求
Only one environment variable is required: MATON_API_KEY. That is proportionate because the skill calls Maton-managed endpoints and needs that key to authenticate. Note: granting MATON_API_KEY to this skill effectively grants Maton (and any actor who can present that key) the ability to operate the configured Google Workspace connections, so protect the key and use least-privilege connections/scopes in Maton.
✓ 持久化与权限
always is false and the skill is user-invocable. Autonomous agent invocation is allowed (disable-model-invocation is false) — this is the platform default and not itself a red flag. The skill does not request system-wide config paths or other skills' credentials.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.42026/2/4
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install google-workspace-admin
镜像加速npx clawhub@latest install google-workspace-admin --registry https://cn.longxiaskill.com