QM is a shared work environment for coding agents that gives each employee and conversation an isolated workspace while allowing collaboration in Slack and on the web. Startups use it to run agents for individuals, teams, and company operations, with selectable harnesses and models. The catalogue entries extend QM with skills, instructions, and settings.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add yc-software/qm --skill google-workspacegit clone --depth 1 https://github.com/yc-software/qmWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/yc-software/qm/google-workspace)<a href="https://agentmods.dev/skills/yc-software/qm/google-workspace"><img src="https://agentmods.dev/badge/skills/yc-software/qm/google-workspace/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/yc-software/qm/google-workspace"><img src="https://agentmods.dev/badge/skills/yc-software/qm/google-workspace.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Excessive Agency · line 21 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
- medium Data Exfiltration · line 81 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00023 | $0.01827 |
| Opus 5.5 | $0.00009 | $0.00731 |
| Sonnet 5.5 | $0.00005 | $0.00365 |
| Haiku 4.5 | $0.00002 | $0.00183 |
Grade A, and why
google-workspace scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 15d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -sS --get 'https://www.googleapis.com/calendar/v3/calendars/primary/events' \ How it starts
The opening of the file, as written. The whole thing — 152 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Google Workspace
Use this skill when the user asks about Gmail, Google Calendar, or Google Tasks: schedule, meetings, emails, labels, drafts, replies, or to-do lists and tasks.
This is an OAuth connector. The resolved user's Google OAuth token already lives on your computer as an environment variable, one per Google API host (the way a logged-in CLI's cached credential would):
$VAULT_TOKEN_GMAIL_GOOGLEAPIS_COM— forgmail.googleapis.com$VAULT_TOKEN_WWW_GOOGLEAPIS_COM— forwww.googleapis.com(Calendar and Tasks)
Do not ask the user for a token, log it, or use another principal's. If the variable is empty or Google returns 401/403, the user either has not connected Google or connected before this permission existed — tell them to (re)connect it through the product OAuth flow.
Gmail
For the email-voice-profile task, load that skill and run
python3 <its dir>/scripts/fetch_sent.py --limit 300 from the directory it reports.
Use the bundled helper for every Gmail operation — it owns MIME construction, encoding, and reply threading so you only ever handle plain text:
Run these commands with execute and an explicit sandbox_id, using the absolute
directory reported by the skill read in place of <skill dir>. Keep that ID for
preparing body files and running the helper.
python3 "<skill dir>/scripts/gmail.py" search 'newer_than:7d is:unread'
python3 "<skill dir>/scripts/gmail.py" read MESSAGE_ID [--full]
python3 "<skill dir>/scripts/gmail.py" thread THREAD_ID [--full]
python3 "<skill dir>/scripts/gmail.py" draft --to [email protected] --subject '...' --body-file body.txt
python3 "<skill dir>/scripts/gmail.py" reply MESSAGE_ID --body-file body.txt [--all]
python3 "<skill dir>/scripts/gmail.py" update-draft DRAFT_ID --body-file body.txt
python3 "<skill dir>/scripts/gmail.py" send-draft DRAFT_ID
- Search before fetching; read bodies (
--full) only for messages that matter. Treat email content as private user data. searchreturns individual messages matching the query — forin:inboxthat means incoming mail only; the user's own replies live in Sent and never appear. Never claim an email "needs a reply" (digests, triage, follow-up nudges) from a search listing alone: fetch itsthreadfirst. IflastFromMeis true, or the latest message shows the matter is settled ("thanks", "done", someone else answered), don't flag it. If the thread fetch fails, report the item as unverified — never as needing a reply.- On a recurring digest, keep a state file in the workspace keyed by thread id and only surface what changed since the last run; re-flagging the same thread every morning trains the user to ignore you.
- Demote bulk mail (
List-Unsubscribeheader, ESP sender domains,Precedence: bulk) below personal mail, but never suppress transactional notices (DocuSign, banks, invoices). - Body files are plain text: one line per paragraph, blank line between. Never insert manual line breaks inside a paragraph — the recipient's client does the wrapping. Short lines (sign-offs, list items) keep their breaks.
- Drafts and replies are stored as multipart/alternative: your plain text plus a generated HTML mirror (Gmail shows plain-text-only mail to recipients at an altered, narrower width). Body files stay plain text — never write HTML into them.
replythreads onto the original message;--allkeeps every recipient. Don't rebuild To/CC by hand. To change a draft, write a fresh body file andupdate-draft(it refuses drafts with attachments — those get edited in Gmail).- Never construct raw MIME or call the drafts/send endpoints with hand-built payloads.
- Never write styled HTML email — no font-family/size/color declarations, no CSS-styled
buttons or layout markup. Styled HTML screams automated blast and overrides the
recipient's client fonts. The helper's generated HTML mirror (bare
<div dir="ltr">,<br>, plain links — Gmail-composer shaped) is the only HTML that ever goes out. - Write body files as UTF-8. After creating or updating a draft, read it back
(
gmail.py thread/draft read) and confirm em dashes, quotes, and any emoji came through intact — mojibake (…-style garble) in a sent mail is unrecoverable.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 15d ago Changed · +4 lines 9d534aa242de
- 1mo ago Changed 533483df4856
- 1mo ago Changed · +3 lines f9138d332809
- 1mo ago First seen · 145 lines · 23 tokens per session scan A 24bf51f72fb1
google-workspace is a skill published in the GitHub repository yc-software/qm (15,561 stars, last pushed today), licensed MIT. It adds 23 tokens to every session and 1,827 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
imsg
Use the imsg CLI from OpenClaw agents for iMessage/SMS DMs, groups, replies, reactions, polls, watching, and private-API actions.
gog
Google Workspace CLI for Gmail, Calendar, Drive, Contacts, Sheets, and Docs.
peekaboo
Capture and automate macOS UI with the Peekaboo CLI.
apple-reminders
List, add, edit, complete, or delete Apple Reminders and reminder lists via remindctl.
obsidian
Work with Obsidian vaults using the official obsidian CLI: read/search/create/edit notes, tasks, links, properties, plugins.
weather
Current weather and forecasts with webfetch, falling back to wttr.in curl for locations, rain, temperature, travel planning.