Google Workspace CLI setup, Google Chat webhooks, Google Apps Script automation, ElevenLabs voice agents, and MCP server building.
- Stars
- 1,094
- Version
- v1
- Copies
- 0
Overview
Waxell rates it high risk: 14 findings, highest severity critical.
- Highest severity
- critical
- Findings
- 14
- What ran
- Static analysis
A clean result means nothing alarming in what is published, not a guarantee. How the checks work
Skills in this plugin
- elevenlabs-agentsjezwebBuild conversational AI voice agents on the ElevenLabs platform. Configure agent + tools + knowledge base, integrate SDK (React / React… Review findingsEngineeringImages, video & audio1.1k
- google-apps-scriptjezwebBuild Google Apps Script automation for Sheets and Workspace. Custom menus, triggers (onEdit / time-driven / form submit), dialogs,… No issuesDocumentsProductivity1.1k
- google-chat-messagesjezwebSend Google Chat messages via incoming webhooks: text, rich cards (cardsV2), threaded replies. TypeScript types, card builder utility,… No issuesEngineeringAI & agents1.1k
- gws-installjezwebQuick install of the Google Workspace CLI (gws) on an additional machine using existing OAuth credentials. Requires client_secret.json… Review findingsEngineeringAI & agents1.1k
- gws-setupjezwebSet up the Google Workspace CLI (gws) from scratch. Guides through GCP project creation, OAuth credentials, authentication, and installing… Review findingsEngineeringAI & agents1.1k
- mcp-builderjezwebBuild MCP servers in Python with FastMCP. Define tools / resources / prompts, build the server, test locally, deploy to FastMCP Cloud or… Review findingsEngineeringAI & agents1.1k
- nemoclaw-setupjezwebInstall and configure NVIDIA NemoClaw (sandboxed OpenClaw agent platform) on Linux. Handles cloudflared tunnels, Docker cgroup fixes,… High riskEngineeringAI & agents1.1k
- parcel-trackingjezwebTrack parcels and check delivery status for Australian and international couriers. Searches Gmail for dispatch/shipping emails and… No issuesWriting & contentAI & agents1.1k
- stripe-paymentsjezwebAdd Stripe payments to a web app: Checkout Sessions, Payment Intents, subscriptions, webhooks, customer portal, and pricing pages. Covers… Review findingsEngineeringAI & agents1.1k
We don't republish the plugin's instructions. Read them on GitHub at the reviewed commit.
Security
Security scan
Checked 2 days ago
Result
High risk Waxell rates it high risk: 14 findings, highest severity critical.
Checked with static analysis: servers it launches, packages it installs at runtime, scripts piped to a shell and bundled binaries. Nothing was run. How the checks work
Findings (14)
critical · 2
- critical
Tells Claude to download a script and pipe it to a shell
skills/nemoclaw-setup/SKILL.md:49 · skill_risk:S1
- critical
Tells Claude to download a script and pipe it to a shell
skills/nemoclaw-setup/SKILL.md:63 · skill_risk:S1
high · 12
- high
Tells Claude to install unpinned packages (@elevenlabs/react)
skills/elevenlabs-agents/SKILL.md:14 · skill_risk:S2
- high
Tells Claude to install unpinned packages (@elevenlabs/client)
skills/elevenlabs-agents/SKILL.md:15 · skill_risk:S2
- high
Tells Claude to install unpinned packages (@elevenlabs/react-native)
skills/elevenlabs-agents/SKILL.md:16 · skill_risk:S2
- high
Tells Claude to install unpinned packages (@elevenlabs/elevenlabs-js)
skills/elevenlabs-agents/SKILL.md:17 · skill_risk:S2
- high
Tells Claude to install unpinned packages (@elevenlabs/agents-cli)
skills/elevenlabs-agents/SKILL.md:18 · skill_risk:S2
- high
Tells Claude to install unpinned packages (@elevenlabs/cli)
skills/elevenlabs-agents/SKILL.md:305 · skill_risk:S2
- high
Tells Claude to install unpinned packages (@elevenlabs/cli)
skills/elevenlabs-agents/assets/ci-cd-example.yml:25 · skill_risk:S2
- high
Tells Claude to install unpinned packages (@googleworkspace/cli)
skills/gws-install/SKILL.md:28 · skill_risk:S2
- high
Tells Claude to install unpinned packages (@googleworkspace/cli)
skills/gws-setup/SKILL.md:39 · skill_risk:S2
- high
Tells Claude to install unpinned packages (fastmcp)
skills/mcp-builder/SKILL.md:26 · skill_risk:S2
- high
Tells Claude to install unpinned packages (openclaw@latest)
skills/nemoclaw-setup/SKILL.md:275 · skill_risk:S2
- high
Tells Claude to install unpinned packages (stripe, @stripe/stripe-js)
skills/stripe-payments/SKILL.md:36 · skill_risk:S2
Versions
Version history
Each distinct content we have seen, newest first, with the verdict it got at the time.
One version so far: v1, seen 2026-11-03.
Files
Files
47 files, 235 KB in total. Names only; open them on GitHub.
- .claude-plugin/plugin.json
- commands/elevenlabs-agents.md
- commands/google-apps-script.md
- commands/google-chat-messages.md
- commands/gws-install.md
- commands/gws-setup.md
- commands/mcp-builder.md
- commands/parcel-tracking.md
- commands/stripe-payments.md
- skills/elevenlabs-agents/SKILL.md
- skills/elevenlabs-agents/assets/agent-config-schema.json
- skills/elevenlabs-agents/assets/ci-cd-example.yml
- skills/elevenlabs-agents/assets/javascript-sdk-boilerplate.js
- skills/elevenlabs-agents/assets/react-native-boilerplate.tsx
- skills/elevenlabs-agents/assets/react-sdk-boilerplate.tsx
- skills/elevenlabs-agents/assets/simulation-template.json
- skills/elevenlabs-agents/assets/swift-sdk-boilerplate.swift
- skills/elevenlabs-agents/assets/system-prompt-template.md
- skills/elevenlabs-agents/assets/widget-embed-template.html
- skills/elevenlabs-agents/references/api-reference.md
- skills/elevenlabs-agents/references/compliance-guide.md
- skills/elevenlabs-agents/references/workflow-examples.md
- skills/google-apps-script/SKILL.md
- skills/google-chat-messages/SKILL.md
- skills/google-chat-messages/assets/card-builder.ts
- skills/google-chat-messages/assets/types.ts
- skills/google-chat-messages/assets/webhook-sender.ts
- skills/gws-install/SKILL.md
- skills/gws-setup/SKILL.md
- skills/mcp-builder/SKILL.md
- skills/mcp-builder/assets/SCRIPTS-TEMPLATE.md
- skills/mcp-builder/assets/api-client-pattern.py
- skills/mcp-builder/assets/basic-server.py
- skills/mcp-builder/assets/client-example.py
- skills/mcp-builder/assets/error-handling.py
- skills/mcp-builder/assets/openapi-integration.py
- skills/mcp-builder/assets/prompts-examples.py
- skills/mcp-builder/assets/pyproject.toml
- skills/mcp-builder/assets/requirements.txt
- skills/mcp-builder/assets/resources-examples.py
- skills/mcp-builder/assets/script-template.ts
- skills/mcp-builder/assets/self-contained-server.py
- skills/mcp-builder/assets/tools-examples.py
- skills/mcp-builder/references/integration-patterns.md
- skills/nemoclaw-setup/SKILL.md
- skills/parcel-tracking/SKILL.md
- skills/stripe-payments/SKILL.md
See and control which skills your people use
Inside your organization, Waxell scans each skill and plugin before anyone installs it, approves what passes and publishes it to a private marketplace, and puts every MCP tool call behind one governed URL.
30 minutes. No commitment.
SOC 2 Type II attested · ISO/IEC 27001:2022 certified · HIPAA with a BAA · aligned to the EU AI Act and NIST AI RMF
More engineering skills and plugins
- elevenlabs-agentsjezwebBuild conversational AI voice agents on the ElevenLabs platform. Configure agent + tools + knowledge base, integrate SDK (React / React… Review findingsEngineeringImages, video & audio1.1k
- google-chat-messagesjezwebSend Google Chat messages via incoming webhooks: text, rich cards (cardsV2), threaded replies. TypeScript types, card builder utility,… No issuesEngineeringAI & agents1.1k
- gws-installjezwebQuick install of the Google Workspace CLI (gws) on an additional machine using existing OAuth credentials. Requires client_secret.json… Review findingsEngineeringAI & agents1.1k
- gws-setupjezwebSet up the Google Workspace CLI (gws) from scratch. Guides through GCP project creation, OAuth credentials, authentication, and installing… Review findingsEngineeringAI & agents1.1k