📦 Gws Forms — 读写谷歌表单
v1.0.12一键读取与写入 Google Forms，支持自动创建、更新问卷及实时收集结果，无缝集成工作流。
0· 466·13 当前·13 累计
by 下载技能包
最后更新
2026/4/22
安全扫描
OpenClaw
可疑
medium confidenceThe skill's stated purpose (read/write Google Forms) matches its use of a 'gws' CLI, but its runtime instructions refer to an external shared SKILL.md for authentication and global flags while declaring no credentials or config requirements — an inconsistency that could hide where and how Google credentials are accessed.
评估建议
This skill looks like a thin wrapper around a 'gws' CLI for Google Forms, but its SKILL.md tells the agent to read an external ../gws-shared/SKILL.md for authentication and rules while the registry lists no credentials or config paths. Before installing, verify: 1) where and how the 'gws' CLI gets authenticated (local OAuth cache, service account files, or env vars), 2) whether a ../gws-shared/SKILL.md exists in your environment and what secrets it contains, and 3) the provenance and trustworthi...详细分析 ▾
ℹ 用途与能力
Name/description (Google Forms read/write) align with requiring the 'gws' CLI; asking for a gws binary is reasonable. However, the skill manifest declares no credentials or config paths while the SKILL.md explicitly instructs the agent to read a sibling file (../gws-shared/SKILL.md) for auth and security rules, which is not declared in the registry metadata.
⚠ 指令范围
Runtime instructions tell the agent to run 'gws forms ...' and to inspect schemas — appropriate for a CLI-backed Forms skill. But they also instruct the agent to read ../gws-shared/SKILL.md for authentication and security rules; that directive requires accessing a file outside the skill and potentially exposes or depends on credentials/config the registry does not list.
✓ 安装机制
Instruction-only skill with no install spec and no code files means nothing is downloaded or written by the skill itself — low install risk. The security surface is the external 'gws' binary and whatever it does.
⚠ 凭证需求
The skill declares no required environment variables or primary credential, yet the SKILL.md defers authentication to an external shared SKILL.md. That omission means the registry metadata doesn't tell you what secrets or local config will actually be used (OAuth tokens, service account keys, or stored CLI credentials).
ℹ 持久化与权限
always:false and no install steps are normal. Still, instructions explicitly reference another skill's file path (../gws-shared/SKILL.md), which implies read access to sibling skill configuration; the manifest did not declare any cross-skill config access, creating a privilege/visibility gap.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.122026/3/5
- Updated skill metadata version from 0.22.4 to 0.22.5 in SKILL.md.
● 无害
安装命令
点击复制官方npx clawhub@latest install gws-forms
镜像加速npx clawhub@latest install gws-forms --registry https://cn.longxiaskill.com