Agent skill · Audited from source
gws-events
skill · googleworkspace/cliApache-2.0 licenceAudited 31 Oct 2026 · source d6cca85ff77c
Is it safe? With care — CAUTION, grade B (89/100). We read this skill's source at commit d6cca85ff77c and found no filesystem, network or shell access and no hard-coded secrets. The audit raised 1 finding, 0 critical or high. What it does: Subscribe to Google Workspace events.
Cite
Cite this page
ModelsAtlas. “gws-events (googleworkspace/cli)”. Retrieved 31 Oct 2026. https://modelsatlas.com/skills/googleworkspace/gws-events
Trust audit
Audit 0.4.1 · source read 31 Oct 2026
CAUTION means the audit found things worth knowing before you trust this skill. Grade B is shared by 16,667 of 17,602 audited skills.
What the source does
- FilesystemNone observedNo reads or writes in the source
- NetworkNone observedNo outbound calls in the source
- ShellNone observedNo commands run in the source
- DependenciesPinnedNothing floats
- SecretsNone foundNo keys in source
Five audit layers
| Layer | What we check | Result | Findings |
|---|---|---|---|
L0 Provenance | Repo owner, licence, archive status, activity | PASS | 0 |
L1 Static source | Secrets, path traversal, supply chain, hidden code | NA | 0 |
L2 Instructions | Prompt injection, authority framing, hidden directives | WARN | 1 |
L3 Inventory | The files and declarations match the source | PASS | 0 |
L4 Sandbox | Run in isolation and watch behaviour | SKIPPED why | 0 |
Gates applied: no behavioural pass.
Findings (1)
MEDIUMPrompt injectionreview.instruction_override · SKILL.md
Read `../gws-shared/SKILL.md` for auth, global flags, and security rules.
- Why
- It instructs the agent to load and obey an external file containing security rules, extending the package's reach to files outside its own scope.
- Fix
- rewrite it so the instruction says plainly what it does, and asks the user before it acts
Audit 0.4.1 · source sha d6cca85ff77c · 31 Oct 2026Report an issue or request a re-scan
Provenance
Who published it, and what the verdict is pinned to
- Publishergoogleworkspace GitHub organizationOwner of the repository this skill is read from
- Source foldergoogleworkspace/cli/skills/gws-eventsThe exact folder we audited
- LicenceApache-2.0As the repository states it
- Commit pinned for this verdictd6cca85ff77cA new audit runs when the source changes
- Repository statusNot archivedPushed today
- Sandboxed runNot runSkills are read, not executed; layer L4 is skipped
What it tells the agent
Full source on GitHub ↗Its description: Subscribe to Google Workspace events.
---
name: gws-events
description: "Subscribe to Google Workspace events."
metadata:
version: 0.22.5
openclaw:
category: "productivity"
requires:
bins:
- gws
cliHelp: "gws events --help"
---
# events (v1)
> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
```bash
gws events <resource> <method> [flags]
```
## Helper Commands
| Command | Description |
|---------|-------------|
| [`+subscribe`](../gws-events-subscribe/SKILL.md) | Subscribe to Workspace events and stream them as NDJSON |
| [`+renew`](../gws-events-renew/SKILL.md) | Renew/reactivate Workspace Events subscriptions |
## API Resources
### message
- `stream` — SendStreamingMessage is a streaming call that will return a stream of task update events until the Task is in an interrupted or terminal state.
### operations
- `get` — Gets the latest state of a long-running operation. Clients can use this method to poll the operation result at intervals as recommended by the API service.
### subscriptions
- `create` — Creates a Google Workspace subscription. To learn how to use this method, see [Create a Google Workspace subscription](https://developers.google.com/workspace/events/guides/create-subscription).
- `delete` — Deletes a Google Workspace subscription. To learn how to use this method, see [Delete a Google Workspace subscription](https://developers.google.com/workspace/events/guides/delete-subscription).
- `get` — Gets details about a Google Workspace subscription. To learn how to use this method, see [Get details about a Google Workspace subscription](https://developers.google.com/workspace/events/guides/get-subscription).
- `list` — Lists Google Workspace subscriptions. To learn how to use this method, see [List Google Workspace subscriptions](https://developers.google.com/workspace/events/guides/list-subscriptions).
- `patch` — Updates or renews a Google Workspace subscription. To learn how to use this method, see [Update or renew a Google Workspace subscription](https://developers.google.com/workspace/events/guides/update-subscription).
- `reactivate` — Reactivates a suspended Google Workspace subscription. This method resets your subscription's `State` field to `ACTIVE`. Before you use this method, you must fix the error that suspended the subscription. This method will ignore or reject any subscription that isn't currently in a suspended state. To learn how to use this method, see [Reactivate a Google Workspace subscription](https://developers.google.com/workspace/events/guides/reactivate-subscription).
### tasks
- `cancel` — Cancel a task from the agent. If supported one should expect no more task updates for the task.
- `get` — Get the current state of a task from the agent.
- `subscribe` — TaskSubscription is a streaming call that will return a stream of task update events. This attaches the stream to an existing in process task. If the task is complete the stream will return the completed task (like GetTask) and close the stream.
- `pushNotificationConfigs` — Operations on the 'pushNotificationConfigs' resource
## Discovering Commands
Before calling any API method, inspect it:
```bash
# Browse resources and methods
gws events --help
# Inspect a method's required params, types, and defaults
gws schema events.<resource>.<method>
```
Use `gws schema` output to build your `--params` and `--json` flags.Excerpt, first 3,493 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.
Install
Pinned to the audited commit d6cca85
git clone https://github.com/googleworkspace/cli git -C cli checkout d6cca85ff77c
The author documents no install command, so this uses the repository directly. Our verdict covers commit d6cca85ff77c only.
Works in which agents?
What its own text says, not a test
| Agent | Status | More |
|---|---|---|
| OpenClaw | Mentioned in its text, not tested | Skills for OpenClaw · About OpenClaw |
Audit history
Every audit, every source change
- !CAUTION B 89 / 100
first audit · source
d6cca85ff77c
README badge
For maintainers · shows the latest audit
[](https://modelsatlas.com/skills/googleworkspace/gws-events/)
The badge shows our verdict and grade for this skill, and links back to this page. It changes when the audit does.
Similar skills
All automation skills →googleworkspace/cli
Google Workspace Events: Renew/reactivate Workspace Events subscriptions.
googleworkspace/cli
Google Workspace Events: Subscribe to Workspace events and stream them as NDJSON.
googleworkspace/cli
Google Drive: Upload a file with automatic metadata.
googleworkspace/cli
Google Docs: Append text to a document.
googleworkspace/cli
Google Drive: Manage files, folders, and shared drives.
googleworkspace/cli
Read and write Google Docs.
Add this badge to your README
[](https://modelsatlas.com/skills/googleworkspace/gws-events/)
<a href="https://modelsatlas.com/skills/googleworkspace/gws-events/"><img src="https://modelsatlas.com/skills/googleworkspace/gws-events/badge.svg" alt="ModelsAtlas: CAUTION B"></a>
Questions about gws-events
What does the gws-events skill do?
Is gws-events safe to install?
What can gws-events access on my machine?
Which assistants does gws-events work with?
How current is this page?
Sources
- github.com/googleworkspace/cli/tree/main/skills/gws-events — the audited source at commit d6cca85ff77c and every finding aboveObserved · 31 Oct 2026
Spotted something wrong? Report a correction · Methodology
Keep going in your AI
Opens with this page as the source. We add nothing else to the prompt.
- What does the gws-events skill do?
- Is gws-events safe to install?
- What can gws-events access on my machine?