Gws AdminBLOCK

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: gws-admin-reports
description: "Google Workspace Admin SDK: Audit logs and usage reports."
metadata:
  version: 0.22.5
  openclaw:
    category: "productivity"
    requires:
      bins:
        - gws
    cliHelp: "gws admin-reports --help"
---

# admin-reports (reports_v1)

> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.

```bash
gws admin-reports <resource> <method> [flags]
```

## API Resources

### activities

  - `list` — Retrieves a list of activities for a specific customer's account and application such as the Admin console application or the Google Drive application. For more information, see the guides for administrator and Google Drive activity reports. For more information about the activity report's parameters, see the activity parameters reference guides.
  - `watch` — Start receiving notifications for account activities. For more information, see Receiving Push Notifications.

### channels

  - `stop` — Stop watching resources through this channel.

### customerUsageReports

  - `get` — Retrieves a report which is a collection of properties and statistics for a specific customer's account. For more information, see the Customers Usage Report guide. For more information about the customer report's parameters, see the Customers Usage parameters reference guides.

### entityUsageReports

  - `get` — Retrieves a report which is a collection of properties and statistics for entities used by users within the account. For more information, see the Entities Usage Report guide. For more information about the entities report's parameters, see the Entities Usage parameters reference guides.

### userUsageReport

  - `get` — Retrieves a report which is a collection of properties and statistics for a set of users with the account. For more information, see the User Usage Report guide. For more information about the user report's parameters, see the Users Usage parameters reference guides.

## Discovering Commands

Before calling any API method, inspect it:

```bash
# Browse resources and methods
gws admin-reports --help

# Inspect a method's required params, types, and defaults
gws schema admin-reports.<resource>.<method>
```

Use `gws schema` output to build your `--params` and `--json` flags.

BLOCKgrade F · trust 49/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

What the source does

Filesystem

declared (5 observation(s))

Network

declared (1 observation(s))

Shell

declared (4 observation(s))

Dependencies

not all pinned

Secrets in source

found

Findings (17)

"private_key": "-----BEGIN PRIVATE KEY-----\nMIIEvwIBADANBgkqhkiG9w0BAQEFAASC\n-----END PRIVATE KEY-----\n",

"private_key": "-----BEGIN PRIVATE KEY-----\nMIIEvwIBADANBgkqhkiG9w0BAQEFAASC\n-----END PRIVATE KEY-----\n",

- `list` — List all "Other contacts", that is contacts that are not in a contact group. "Other contacts" are typically auto created contacts from interactions. Sync tokens expire 7 days after the full

| `--preset` | — | — | Use a preset template: jailbreak |

gws modelarmor +create-template --project P --location us-central1 --template-id my-tmpl --preset jailbreak

- Defaults to the jailbreak preset if neither --preset nor --json is given.

console.log(`Token cannot add labels for this review event (${e.message}) — skipping`);

params.insert("name".to_string(), json!("projects/../../etc/passwd"));

let matches = make_matches_subscribe(&["test", "--output-dir", "../../etc"]);

let matches = make_matches_watch(&["test", "--output-dir", "../../etc"]);

let matches = make_matches_watch(&["test", "--subscription", "../../evil"]);

Ok(include_str!("../../templates/modelarmor/jailbreak.json").to_string())

@changesets/cli, lefthook

**Fix:** Open the [OAuth consent screen](https://console.cloud.google.com/apis/credentials/consent) in your GCP project → **Test users** → **Add users** → enter your Google account email. Then retry `

Workspace admins can still select these scopes manually via the "Full Access"

| `GOOGLE_WORKSPACE_CLI_TOKEN` | Pre-obtained OAuth2 access token (highest priority; bypasses all credential file loading) |

Closes #623. The CLI no longer writes a fallback `.encryption_key` text file on macOS and Windows when securely storing credentials. Instead, it strictly uses the native OS keychain (Keychain Access o

Gates applied: critical_finding, instruction_override, no_behavioural_pass, undeclared_transfer.

[![ModelsAtlas audit: Gws Admin](https://modelsatlas.com/skills/googleworkspace/gws-admin/badge.svg)](https://modelsatlas.com/skills/googleworkspace/gws-admin/)

Not your listing, or something out of date? Claim or update your listing.