Google Keep notes via gkeepapi. List, search, create, and manage notes.
Security Analysis
high confidenceThe skill is internally consistent with a CLI wrapper for gkeepapi — it functions as described, requests no unrelated credentials, and stores a local token — but there are a few small mismatches you should be aware of before installing.
Name, description, and the provided Python CLI (gkeep.py) implement Google Keep operations via gkeepapi (list, search, create, archive, delete, pin, etc.). Required binaries list includes 'gkeep', which matches the CLI provided. No unrelated services or credentials are requested.
SKILL.md stays on-purpose (login, list, search, create, manage notes). It documents the use of an app password and that tokens are stored at ~/.config/gkeep/token.json. Minor mismatch: SKILL.md says first run bootstraps a venv at 'skills/gkeep/.venv' but package.json/postinstall would create '.venv' in the package directory — the runtime code itself does not reference that venv path. No instructions ask to read or exfiltrate unrelated files.
There is no explicit install spec provided to the platform (instruction-only), which is low-risk. However, the bundle includes a package.json with a postinstall script that will create a Python venv and pip-install requirements if an npm install were run. That postinstall is not executed by the platform by default but is important to notice if you manually install via npm or run package scripts.
The skill declares no required environment variables, which is appropriate. The code does read an optional GKEEP_PASSWORD env var during login (fallback to interactive prompt) but this env var is not declared in metadata — benign but a minor documentation gap. Tokens (keep.getMasterToken()) are saved to ~/.config/gkeep/token.json with 0o600 permissions per the code, which is expected for local credential storage.
always:false and normal invocation settings. The skill persists a token in the user's home config directory (expected for a CLI client) and may create a local venv when installed/run; it does not request system-wide privileges or modify other skills.
Guidance
This skill appears to do what it says: a CLI wrapper around gkeepapi that stores a local token in ~/.config/gkeep/token.json. Before installing or running it: 1) Verify you trust the package source (the repo homepage is provided). 2) Prefer using a Google App Password as recommended; avoid placing your account password in environment variables. 3) Note the bundle includes package.json with a postinstall script — running npm install or package postinstall will execute commands to create a venv and install Python dependencies, so only do that from a trusted source. 4) Inspect or backup the token file and consider revoking the app password/token in your Google account if you stop using the skill. 5) Small inconsistencies (venv path and package bin name) look like packaging/documentation issues rather than malicious behavior, but confirm install/run steps match how you plan to use it.
Latest Release
v1.0.3
Updated metadata and author to use openclaw instead of clawdbot
More by @VACInc
Published by @VACInc on ClawHub
