google

name	google
description	Manage Gmail and Google Calendar with capability-backed auth and operations. Use when asked to check inbox, summarize emails, give a day at a glance, send an email, review calendar events, or schedule meetings.
opt_in	true
sensitive	true
access	{"chat_types":["private"]}
capabilities	["gog.email","gog.calendar"]
allowed_tools	["bash"]
max_iterations	25
input_schema	{"type":"object","properties":{"task":{"type":"string","description":"The Google email/calendar task to perform"}},"required":["task"]}

Manage Gmail and Google Calendar through host-managed capabilities.

Use progressive disclosure:

• Read references/gmail-workflows.md when handling summaries, inbox triage, day-at-a-glance planning, or Gmail query choices.
• Read references/auth-and-failures.md when auth is incomplete/expired or capability commands fail.
• Read references/output-templates.md when producing summary/day-plan output sections.

Security Contract

• Use ash-sb capability for every Gmail/Calendar operation.
• Never read or request raw OAuth access tokens, refresh tokens, or client secrets.
• Do not fabricate capability results. Only report data returned by commands.

Workflow

On every invocation, follow these steps in order:

1. Check capability status

ash-sb capability list

• If a needed capability is missing, tell the user to enable [skills.google] and stop.
• If a needed capability is not authenticated, run auth (step 2).
• If already authenticated, continue to operations (step 3).

2. Authenticate (when needed)

For each unauthenticated capability (gog.email, gog.calendar):

ash-sb capability auth begin -c gog.email --account work

Parse the command output and extract auth fields before responding. If auth_url is missing from output, report the command failure and stop.

Then:

• If flow type is device_code: show URL + user code, then poll.
• If flow type is authorization_code: show URL and ask user for callback URL or code, then complete.

When presenting auth instructions, always include:

• The exact flow_id returned by auth begin.
• The exact auth_url returned by auth begin (never paraphrase or omit it).
• The exact user_code when flow type is device_code.
• A single clear instruction: complete consent, then paste callback URL or code.

Use one of these response templates exactly:

Authorization code flow: To continue, open this Google auth URL: <auth_url>\nFlow ID: <flow_id>\nAfter approval, paste the full callback URL (or just the code) here.