Google Workspace Cli

What the source does

• FilesystemNone observedNo reads or writes in the source
• NetworkNone observedNo outbound calls in the source
• ShellNone observedNo commands run in the source
• DependenciesPinnedNothing floats
• SecretsNone foundNo keys in source

Five audit layers

Gates applied: no behavioural pass.

.codex/skills/a11y-audit

.codex/skills/ab-test-setup

.codex/skills/account-executive

.codex/skills/ad-creative

.codex/skills/aeo

1. **Super Admin** - Full access (limit to 2-3 accounts)

Audit 0.4.1 · source sha 6e3fcbdbb5cf · 19 Oct 2026Report an issue or request a re-scan

• Publisherborghei GitHub userOwner of the repository this skill is read from
• Source folderborghei/Claude-Skills/engineering/google-workspace-cliThe exact folder we audited
• LicenceNOASSERTIONAs the repository states it
• Commit pinned for this verdict6e3fcbdbb5cfA new audit runs when the source changes
• Repository statusNot archivedLast push 12 days ago
• Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

Its description: This skill should be used when the user asks to "audit Google Workspace", "check GWS security settings", "set up Google Workspace authentication", "diagnose Workspace issues", or "review Google admin configurations".

---
name: google-workspace-cli
description: >
  This skill should be used when the user asks to "audit Google Workspace",
  "check GWS security settings", "set up Google Workspace authentication",
  "diagnose Workspace issues", or "review Google admin configurations".
license: MIT + Commons Clause
metadata:
  version: 1.0.0
  author: borghei
  category: engineering
  domain: google-workspace
  updated: 2026-04-02
  tags: [google-workspace, gws, admin, security, audit]
---
# Google Workspace CLI

> **Category:** Engineering
> **Domain:** Google Workspace Administration

## Overview

The **Google Workspace CLI** skill provides tools for auditing Google Workspace configurations, generating authentication setup documentation, and diagnosing common GWS issues. It helps IT administrators maintain secure, well-configured Workspace environments without needing to navigate complex admin consoles.

## Clarify First

Before running, confirm these inputs. If any is unknown or vague, ASK — do not assume:

- [ ] **Task** — security audit, auth setup guide, or diagnostics (selects `workspace_audit.py` vs `auth_setup_guide.py` vs `gws_doctor.py`)
- [ ] **Config export or auth method** — the GWS config JSON to audit, or the auth method and scopes for a setup guide (sets `--config` or `--method`/`--scopes`)
- [ ] **Output mode** — human-readable vs JSON for automation (sets `--format json`)

Stop rule: ask only the 2-3 that most change the output. If the user says "just draft it," proceed and list your assumptions at the top of the artifact.

## Quick Start

```bash
# Audit Workspace security configuration
python scripts/workspace_audit.py --config gws-config.json

# Generate auth setup guide
python scripts/auth_setup_guide.py --method oauth --scopes admin,drive

# Run diagnostics
python scripts/gws_doctor.py --check all

# JSON output for automation
python scripts/workspace_audit.py --config gws-config.json --format json
```

## Tools Overview

### workspace_audit.py

Audits Google Workspace configuration exports for security best practices.

| Feature | Description |
|---------|-------------|
| 2FA enforcement | Checks if 2-step verification is required |
| Password policy | Validates password strength requirements |
| Sharing settings | Reviews external sharing configurations |
| App access | Checks third-party app access policies |
| Admin roles | Reviews admin role assignments |
| Mobile management | Checks device management policies |
| Drive settings | Validates Drive sharing and access controls |

### auth_setup_guide.py

Generates step-by-step authentication setup documentation for GWS API access.

| Feature | Description |
|---------|-------------|
| OAuth setup | Generates OAuth 2.0 configuration guide |
| Service account | Creates service account setup documentation |
| API scopes | Lists required scopes for each API |
| Domain delegation | Documents domain-wide delegation setup |
| Testing guide | Provides verification steps |

### gws_doctor.py

Diagnostic tool for common Google Workspace configuration issues.

| Feature | Description |
|---------|-------------|
| DNS checks | Validates MX, SPF, DKIM, DMARC records format |
| SSL/TLS | Checks certificate and transport security settings |
| Integration health | Validates common integration patterns |
| Config consistency | Checks for conflicting settings |
| Best practices | Compares against GWS recommended settings |

## Workflows

### Security Audit Workflow

1. **Export config** - Export GWS settings to JSON via Admin SDK or manual export
2. **Audit** - Run workspace_audit.py against the config file
3. **Review findings** - Prioritize critical security gaps
4. **Remediate** - Apply recommended settings in Admin Console
5. **Re-audit** - Verify changes resolved findings

### API Setup Workflow

1. **Plan** - Determine which APIs and scopes are needed
2. **Generate guide** - Run auth_setup_guide.py with desired method
3. **Follow steps** - Create credentials in Google Cloud Console
4. **Configure** - Set up domain delegation if needed
5. **Verify** - Test API access with provided verification steps

### Health Check Workflow

1. **Run diagnostics** - Execute gws_doctor.py with all checks
2. **Review results** - Check DNS, email, and integration health
3. **Fix issues** - Address failures in priority order
4. **Re-check** - Verify fixes pass diagnostics

### Regular Maintenance

```bash
# Monthly security audit
python scripts/workspace_audit.py --config gws-export.json --format json > audit_$(date +%Y%m).json

# Weekly health check
python scripts/gws_doctor.py --check dns,email --format json
```

## Reference Documentation

- [GWS Admin Guide](references/gws-admin-guide.md) - Security settings, API configuration, DNS requirements

## Common Patterns Quick Reference

### Security Priorities
| Setting | Priority | Impact |
|---------|----------|--------|
| 2FA enforcement | Critical | Prevents account takeover |
| Password policy | Critical | Reduces credential attacks |
| External sharing | High | Prevents data leakage |
| App access control | High | Limits third-party risk |
| Mobile management | Medium | Secures device access |
| Admin role review | Medium | Limits privilege exposure |

### DNS Records for Email
| Record | Purpose | Example |
|--------|---------|---------|
| MX | Email routing | `ASPMX.L.GOOGLE.COM` |
| SPF | Sender verification | `v=spf1 include:_spf.google.com ~all` |
| DKIM | Email signing | Domain-specific CNAME |
| DMARC | Policy enforcement | `v=DMARC1; p=reject; rua=mailto:...` |

### API Scopes
| API | Scope | Purpose |
|-----|-------|---------|
| Admin SDK | `admin.directory.user` | User management |
| Drive | `drive.readonly` | File listing |
| Gmail | `gmail.settings.basic` | Email settings |
| Calendar | `calendar.readonly` | Calendar access |

### Common Issues
| Issue | Symptom | Fix |
|-------|---------|-----|
| No 2FA | Account takeover risk | Enable 2FA enforcement |
| Weak passwords | Credential stuffing | 

Excerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

git clone https://github.com/borghei/Claude-Skills
git -C Claude-Skills checkout 6e3fcbdbb5cf

Works in

1. 2026-10-19
   !CAUTION B 89 / 100

   first audit · source 6e3fcbdbb5cf

Questions about Google Workspace Cli

• github.com/borghei/Claude-Skills/tree/main/engineering/google-wo — the audited source at commit 6e3fcbdbb5cf and every finding aboveObserved · 19 Oct 2026

Spotted something wrong? Report a correction · Methodology