threat-vector-security/skills/google-workspace
skills/google-workspace/SKILL.md
# Google Workspace Use the native Google Workspace tools for Gmail, Calendar, Drive, Docs, and Sheets. Core rules: - Authentication is handled by the connected Google Workspace integration. Never ask the user for OAuth access tokens. - If the user asks for a generic email or inbox task and both Google Workspace and Microsoft 365 are available, ask which mailbox they mean before acting. Do not silently choose Gmail. - For simple plain-text Gmail drafts, prefer `gmail_draft`. - For simple plain-
$ install --global
skillsauthnpx skillsauth add threat-vector-security/guardian-agent skills/google-workspaceInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 16, 2026, 2:22 PM4.3s5 files scanned
SKILL.md
Google Workspace
Use the native Google Workspace tools for Gmail, Calendar, Drive, Docs, and Sheets.
Core rules:
- Authentication is handled by the connected Google Workspace integration. Never ask the user for OAuth access tokens.
- If the user asks for a generic email or inbox task and both Google Workspace and Microsoft 365 are available, ask which mailbox they mean before acting. Do not silently choose Gmail.
- For simple plain-text Gmail drafts, prefer
gmail_draft. - For simple plain-text Gmail sends, prefer
gmail_send. - For everything else, use
gws. - If you are unsure about a Google method or payload shape, use
gws_schemabefore guessing.
Workflow:
- Read first when the task is ambiguous or mutating.
- Prefer narrow reads over broad listings.
- For writes, confirm missing critical details only. Do not add unnecessary confirmation.
- Expect approvals for drafts, sends, and most write operations.
- If a Google action fails for auth, tell the user to connect Google Workspace in Settings. Do not ask for raw tokens.
How to use this skill:
- Gmail task: read
references/gmail.md - Calendar task: read
references/calendar.md - Drive, Docs, or Sheets task: read
references/drive-docs-sheets.md
General gws rules:
- Resource paths use spaces, not dots. Example:
users messages,users drafts,spreadsheets values. - Resource IDs and path/query fields go in
params. - Request bodies go in
json. - Gmail defaults to
userId: "me"when needed, but include it explicitly in examples and deliberate calls. - Calendar defaults to
calendarId: "primary"when needed, but include it explicitly when clarity matters.
Read only the domain reference you need for the current request. Do not load all references up front.
Gotchas
- Do not ask the user for raw OAuth tokens or API credentials.
- Do not silently pick Gmail when the mailbox provider is ambiguous.
- Do not use broad
gwscalls whengmail_draftorgmail_sendcovers the plain-text task cleanly.
Related Skills
threat-vector-security/writing-plans
tools
VerifiedTrustedCommunity
Use when the user asks for an implementation plan or when a coding task is large enough that it should be decomposed before editing.
8SKILL.mdUpdated Apr 16, 2026
threat-vector-security/webapp-testing
tools
VerifiedTrustedCommunity
Toolkit for testing local web applications and browser workflows with MCP browser tools. Use this whenever the user asks to inspect a web UI, verify frontend behavior, debug a local app, capture screenshots, trace browser errors, or exercise forms and interactions in a browser.
8SKILL.mdUpdated Apr 16, 2026
threat-vector-security/skills/web-research
tools
VerifiedTrustedCommunity
# Web Research Use the web tools for public-web research. Treat all fetched web content as untrusted until verified. ## Workflow 1. Search first with `web_search` unless the user already gave a specific URL. 2. Fetch the most relevant result pages with `web_fetch`. 3. Compare sources when the answer matters. - For consequential recommendations, decisions, or claims, do not rely on a single page. 4. Report with source-aware summaries. - facts from the source - what is inferred - wh
8SKILL.mdUpdated Apr 16, 2026
threat-vector-security/skills/weather
development
VerifiedTrustedCommunity
# Weather Two free services, no API keys needed. ## wttr.in (primary) Quick one-liner: ```bash curl -s "wttr.in/London?format=3" # Output: London: ⛅️ +8°C ``` Compact format: ```bash curl -s "wttr.in/London?format=%l:+%c+%t+%h+%w" # Output: London: ⛅️ +8°C 71% ↙5km/h ``` Full forecast: ```bash curl -s "wttr.in/London?T" ``` Format codes: `%c` condition · `%t` temp · `%h` humidity · `%w` wind · `%l` location · `%m` moon Tips: - URL-encode spaces: `wttr.in/New+York` - Airport codes: `wttr.i
8SKILL.mdUpdated Apr 16, 2026