feat(engineering): add google-workspace-cli skill with 5 Python tools

New skill for Google Workspace administration via the gws CLI: - SKILL.md with 4 workflows (Gmail, Drive/Sheets, Calendar, Security Audit) - 5 stdlib-only Python scripts (doctor, auth setup, recipe runner, audit, analyzer) - 3 reference docs, 2 asset files, 43 built-in recipes, 10 persona bundles - cs-workspace-admin agent, /google-workspace slash command - Standalone marketplace plugin entry with .claude-plugin/plugin.json - Cross-platform sync (Codex CLI, Gemini CLI), MkDocs docs pages - All documentation updated (173 skills, 250 tools, 15 agents, 15 commands) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-11 09:59:40 +01:00
parent 778ce17b68
commit 4e9f1d934d
36 changed files with 4307 additions and 49 deletions
--- a/docs/agents/cs-workspace-admin.md
+++ b/docs/agents/cs-workspace-admin.md
@@ -0,0 +1,163 @@
+---
+title: "cs-workspace-admin"
+description: "cs-workspace-admin - Claude Code agent for Engineering - Core."
+---
+
+# cs-workspace-admin
+
+**Type:** Agent | **Domain:** Engineering - Core | **Source:** [`agents/engineering-team/cs-workspace-admin.md`](https://github.com/alirezarezvani/claude-skills/tree/main/agents/engineering-team/cs-workspace-admin.md)
+
+---
+
+
+# cs-workspace-admin
+
+## Role & Expertise
+
+Google Workspace administration specialist orchestrating the gws CLI for email automation, file management, calendar scheduling, security auditing, and cross-service workflows. Manages setup, authentication, 43 built-in recipes, and 10 persona-based bundles.
+
+## Skill Integration
+
+### Skill Location
+`../../engineering-team/google-workspace-cli/`
+
+### Python Tools
+
+1. **GWS Doctor**
+   - **Path:** `../../engineering-team/google-workspace-cli/scripts/gws_doctor.py`
+   - **Usage:** `python3 ../../engineering-team/google-workspace-cli/scripts/gws_doctor.py [--json]`
+   - **Purpose:** Pre-flight diagnostics — checks installation, auth, and service connectivity
+
+2. **Auth Setup Guide**
+   - **Path:** `../../engineering-team/google-workspace-cli/scripts/auth_setup_guide.py`
+   - **Usage:** `python3 ../../engineering-team/google-workspace-cli/scripts/auth_setup_guide.py --guide oauth`
+   - **Purpose:** Guided auth setup, scope listing, .env generation, validation
+
+3. **Recipe Runner**
+   - **Path:** `../../engineering-team/google-workspace-cli/scripts/gws_recipe_runner.py`
+   - **Usage:** `python3 ../../engineering-team/google-workspace-cli/scripts/gws_recipe_runner.py --list`
+   - **Purpose:** Catalog, search, and execute 43 built-in recipes with persona filtering
+
+4. **Workspace Audit**
+   - **Path:** `../../engineering-team/google-workspace-cli/scripts/workspace_audit.py`
+   - **Usage:** `python3 ../../engineering-team/google-workspace-cli/scripts/workspace_audit.py [--json]`
+   - **Purpose:** Security and configuration audit across Workspace services
+
+5. **Output Analyzer**
+   - **Path:** `../../engineering-team/google-workspace-cli/scripts/output_analyzer.py`
+   - **Usage:** `gws ... --json | python3 ../../engineering-team/google-workspace-cli/scripts/output_analyzer.py --count`
+   - **Purpose:** Parse, filter, and aggregate JSON/NDJSON output from any gws command
+
+### Knowledge Bases
+
+1. **Command Reference** — `../../engineering-team/google-workspace-cli/references/gws-command-reference.md`
+   - 18 services, 22 helpers, global flags, environment variables
+2. **Recipes Cookbook** — `../../engineering-team/google-workspace-cli/references/recipes-cookbook.md`
+   - 43 recipes organized by category with persona mapping
+3. **Troubleshooting** — `../../engineering-team/google-workspace-cli/references/troubleshooting.md`
+   - Common errors, auth issues, platform-specific fixes
+
+### Templates
+
+1. **Workspace Config** — `../../engineering-team/google-workspace-cli/assets/workspace-config.json`
+   - Automation config template with auth, defaults, scheduled tasks
+2. **Persona Profiles** — `../../engineering-team/google-workspace-cli/assets/persona-profiles.md`
+   - 10 role-based workflow bundles
+
+## Core Workflows
+
+### 1. Setup & Onboarding
+
+**Goal:** Get gws CLI installed, authenticated, and verified.
+
+**Steps:**
+1. Run `gws_doctor.py` to check installation and existing auth
+2. If not installed, guide through installation (npm/cargo/binary)
+3. Run `auth_setup_guide.py --guide oauth` for auth instructions
+4. Run `auth_setup_guide.py --scopes <services>` to identify required scopes
+5. Run `auth_setup_guide.py --validate` to verify all services
+6. Generate `.env` template with `auth_setup_guide.py --generate-env`
+
+**Example:**
+```bash
+python3 ../../engineering-team/google-workspace-cli/scripts/gws_doctor.py
+python3 ../../engineering-team/google-workspace-cli/scripts/auth_setup_guide.py --guide oauth
+python3 ../../engineering-team/google-workspace-cli/scripts/auth_setup_guide.py --validate --json
+```
+
+### 2. Daily Operations
+
+**Goal:** Execute persona-based daily workflows using recipes.
+
+**Steps:**
+1. Identify user's role and select persona with `gws_recipe_runner.py --personas`
+2. List relevant recipes with `gws_recipe_runner.py --persona <role> --list`
+3. Execute recipes with `gws_recipe_runner.py --run <name>` (use `--dry-run` first)
+4. Pipe output through `output_analyzer.py` for filtering and analysis
+
+**Example:**
+```bash
+python3 ../../engineering-team/google-workspace-cli/scripts/gws_recipe_runner.py --persona pm --list
+python3 ../../engineering-team/google-workspace-cli/scripts/gws_recipe_runner.py --run standup-report --dry-run
+gws recipes standup-report --json | python3 ../../engineering-team/google-workspace-cli/scripts/output_analyzer.py --format table
+```
+
+### 3. Security Audit
+
+**Goal:** Audit Workspace security configuration and remediate findings.
+
+**Steps:**
+1. Run `workspace_audit.py` for full security assessment
+2. Review findings, prioritizing FAIL items
+3. Filter findings through `output_analyzer.py` for actionable items
+4. Execute remediation commands from audit output
+5. Re-run audit to verify fixes
+
+**Example:**
+```bash
+python3 ../../engineering-team/google-workspace-cli/scripts/workspace_audit.py --json
+python3 ../../engineering-team/google-workspace-cli/scripts/workspace_audit.py --json | \
+  python3 ../../engineering-team/google-workspace-cli/scripts/output_analyzer.py --filter "status=FAIL"
+```
+
+### 4. Automation Scripting
+
+**Goal:** Generate multi-step gws scripts for recurring operations.
+
+**Steps:**
+1. Identify the workflow from recipe templates
+2. Use `gws_recipe_runner.py --describe <name>` for command sequences
+3. Customize commands with user-specific parameters
+4. Test with `--dry-run` flag
+5. Combine into shell scripts or scheduled tasks using `workspace-config.json` template
+
+**Example:**
+```bash
+python3 ../../engineering-team/google-workspace-cli/scripts/gws_recipe_runner.py --describe morning-briefing
+# Customize and test
+gws helpers morning-briefing --json | python3 ../../engineering-team/google-workspace-cli/scripts/output_analyzer.py --select "type,summary,time" --format table
+```
+
+## Output Standards
+
+- Diagnostic reports: structured PASS/WARN/FAIL per check with fixes
+- Audit reports: scored findings with risk ratings and remediation commands
+- Recipe output: JSON piped through output_analyzer.py for formatted display
+- Always use `--dry-run` before executing bulk or destructive operations
+
+## Success Metrics
+
+- **Setup Time:** gws installed and authenticated in under 10 minutes
+- **Audit Coverage:** All critical security checks pass (Grade A or B)
+- **Automation:** Daily workflows automated via recipes and scheduled tasks
+- **Troubleshooting:** Common errors resolved using troubleshooting reference
+
+## Related Agents
+
+- [cs-engineering-lead](cs-engineering-lead.md) — Engineering team coordination
+- [cs-senior-engineer](../engineering/cs-senior-engineer.md) — Architecture and CI/CD
+
+## References
+
+- [Skill Documentation](../../engineering-team/google-workspace-cli/SKILL.md)
+- [gws CLI Repository](https://github.com/googleworkspace/cli)
--- a/docs/agents/index.md
+++ b/docs/agents/index.md
@@ -1,11 +1,11 @@
 ---
 title: "Agents"
-description: "All 14 Claude Code agents — multi-skill orchestrators across domains."
+description: "All 15 Claude Code agents — multi-skill orchestrators across domains."
 ---

 # Agents

-14 agents that orchestrate skills across domains.
+15 agents that orchestrate skills across domains.

 | Agent | Domain |
 |-------|--------|
@@ -14,6 +14,7 @@ description: "All 14 Claude Code agents — multi-skill orchestrators across dom
 | [CTO Advisor Agent](cs-cto-advisor.md) | C-Level Advisory |
 | [cs-senior-engineer](cs-senior-engineer.md) | Engineering - POWERFUL |
 | [cs-engineering-lead](cs-engineering-lead.md) | Engineering - Core |
+| [cs-workspace-admin](cs-workspace-admin.md) | Engineering - Core |
 | [cs-financial-analyst](cs-financial-analyst.md) | Finance |
 | [Content Creator Agent](cs-content-creator.md) | Marketing |
 | [Demand Generation Specialist Agent](cs-demand-gen-specialist.md) | Marketing |
--- a/docs/commands/google-workspace.md
+++ b/docs/commands/google-workspace.md
@@ -0,0 +1,84 @@
+---
+title: "/google-workspace"
+description: "/google-workspace — Claude Code slash command."
+---
+
+# /google-workspace
+
+**Type:** Slash Command | **Source:** [`commands/google-workspace.md`](https://github.com/alirezarezvani/claude-skills/tree/main/commands/google-workspace.md)
+
+---
+
+
+# /google-workspace
+
+Google Workspace CLI administration via the `gws` CLI. Run setup diagnostics, security audits, browse and execute recipes, and analyze command output.
+
+## Usage
+
+```
+/google-workspace setup [--json]
+/google-workspace audit [--services gmail,drive,calendar] [--json]
+/google-workspace recipe list [--persona <role>] [--json]
+/google-workspace recipe search <keyword> [--json]
+/google-workspace recipe run <name> [--dry-run]
+/google-workspace recipe describe <name>
+/google-workspace analyze [--filter <field=value>] [--group-by <field>] [--stats <field>] [--format table|csv|json]
+```
+
+## Examples
+
+```
+/google-workspace setup
+/google-workspace audit --services gmail,drive --json
+/google-workspace recipe list --persona pm
+/google-workspace recipe search "email"
+/google-workspace recipe run standup-report --dry-run
+/google-workspace recipe describe morning-briefing
+/google-workspace analyze --filter "mimeType=pdf" --select "name,size" --format table
+```
+
+## Scripts
+
+- `engineering-team/google-workspace-cli/scripts/gws_doctor.py` — Pre-flight diagnostics
+- `engineering-team/google-workspace-cli/scripts/auth_setup_guide.py` — Auth setup guide
+- `engineering-team/google-workspace-cli/scripts/gws_recipe_runner.py` — Recipe catalog & runner
+- `engineering-team/google-workspace-cli/scripts/workspace_audit.py` — Security audit
+- `engineering-team/google-workspace-cli/scripts/output_analyzer.py` — JSON/NDJSON analyzer
+
+## Subcommands
+
+### setup
+Run pre-flight diagnostics and auth validation.
+```bash
+python3 engineering-team/google-workspace-cli/scripts/gws_doctor.py [--json]
+python3 engineering-team/google-workspace-cli/scripts/auth_setup_guide.py --validate [--json]
+```
+
+### audit
+Run security and configuration audit.
+```bash
+python3 engineering-team/google-workspace-cli/scripts/workspace_audit.py [--services gmail,drive,calendar] [--json]
+```
+
+### recipe
+Browse, search, and execute the 43 built-in gws recipes.
+```bash
+python3 engineering-team/google-workspace-cli/scripts/gws_recipe_runner.py --list [--persona <role>] [--json]
+python3 engineering-team/google-workspace-cli/scripts/gws_recipe_runner.py --search <keyword> [--json]
+python3 engineering-team/google-workspace-cli/scripts/gws_recipe_runner.py --describe <name>
+python3 engineering-team/google-workspace-cli/scripts/gws_recipe_runner.py --run <name> [--dry-run]
+```
+
+### analyze
+Parse, filter, and aggregate JSON output from any gws command.
+```bash
+gws <command> --json | python3 engineering-team/google-workspace-cli/scripts/output_analyzer.py [options]
+python3 engineering-team/google-workspace-cli/scripts/output_analyzer.py --demo --format table
+```
+
+## Skill Reference
+-> `engineering-team/google-workspace-cli/SKILL.md`
+
+## Related Commands
+- No direct dependencies (self-contained Google Workspace skill)
--- a/docs/commands/index.md
+++ b/docs/commands/index.md
@@ -1,17 +1,18 @@
 ---
 title: "Commands"
-description: "All 14 slash commands for quick access to common operations."
+description: "All 15 slash commands for quick access to common operations."
 ---

 # Slash Commands

-14 commands for quick access to common operations.
+15 commands for quick access to common operations.

 | Command | Description |
 |---------|-------------|
 | [`/changelog`](changelog.md) | Generate Keep a Changelog entries from git history and validate commit message format. |
 | [`/competitive-matrix`](competitive-matrix.md) | Build competitive matrices with weighted scoring, gap analysis, and market positioning insights. |
 | [`/financial-health`](financial-health.md) | Analyze financial statements, build valuation models, assess budget variances, and construct forecasts. |
+| [`/google-workspace`](google-workspace.md) | Google Workspace CLI administration via the `gws` CLI. Run setup diagnostics, security audits, browse and execute recipes, and analyze command output. |
 | [`/okr`](okr.md) | Generate cascaded OKR frameworks from company-level strategy down to team-level key results. |
 | [`/persona`](persona.md) | Generate structured user personas with demographics, goals, pain points, and behavioral patterns. |
 | [`/pipeline`](pipeline.md) | Detect project stack and generate CI/CD pipeline configurations for GitHub Actions or GitLab CI. |
--- a/docs/getting-started.md
+++ b/docs/getting-started.md
@@ -70,7 +70,7 @@ Choose your platform and follow the steps:

 | Bundle | Install Command | Skills |
 |--------|----------------|--------|
-| **Engineering Core** | `/plugin install engineering-skills@claude-code-skills` | 23 |
+| **Engineering Core** | `/plugin install engineering-skills@claude-code-skills` | 24 |
 | **Engineering POWERFUL** | `/plugin install engineering-advanced-skills@claude-code-skills` | 25 |
 | **Product** | `/plugin install product-skills@claude-code-skills` | 8 |
 | **Marketing** | `/plugin install marketing-skills@claude-code-skills` | 43 |
@@ -112,7 +112,7 @@ AI-augmented development. Optimize for SEO.

 ## Python Tools

-All 245 tools use the standard library only — zero pip installs, all verified.
+All 250 tools use the standard library only — zero pip installs, all verified.

 ```bash
 # Security audit a skill before installing
--- a/docs/index.md
+++ b/docs/index.md
@@ -1,6 +1,6 @@
 ---
 title: Claude Code Skills & Plugins
-description: "172 production-ready skills, 14 agents, and 14 commands for Claude Code, OpenAI Codex, Gemini CLI, and OpenClaw."
+description: "173 production-ready skills, 15 agents, and 15 commands for Claude Code, OpenAI Codex, Gemini CLI, and OpenClaw."
 hide:
  - toc
  - edit
@@ -14,7 +14,7 @@ hide:

 # Claude Code Skills

-172 production-ready skills that transform AI coding agents into specialized professionals.
+173 production-ready skills that transform AI coding agents into specialized professionals.
 { .hero-subtitle }

 **Claude Code** | **OpenAI Codex** | **Gemini CLI** | **OpenClaw**
@@ -27,25 +27,25 @@ hide:

 <div class="grid cards" markdown>

-   :material-counter:{ .lg .middle } **172**
+-   :material-counter:{ .lg .middle } **173**

    ---

    Production-ready skills

-   :material-language-python:{ .lg .middle } **245**
+-   :material-language-python:{ .lg .middle } **250**

    ---

    Python CLI tools (stdlib-only, all verified)

-   :material-robot:{ .lg .middle } **14**
+-   :material-robot:{ .lg .middle } **15**

    ---

    [Multi-skill agents](agents/)

-   :material-console:{ .lg .middle } **14**
+-   :material-console:{ .lg .middle } **15**

    ---

@@ -65,7 +65,7 @@ hide:

    Architecture, frontend, backend, fullstack, QA, DevOps, SecOps, AI/ML, data engineering, Playwright testing, self-improving agent

-    [:octicons-arrow-right-24: 23 skills](skills/engineering-team/)
+    [:octicons-arrow-right-24: 24 skills](skills/engineering-team/)

 -   :material-lightning-bolt:{ .lg .middle } **Engineering — POWERFUL**

--- a/docs/skills/engineering-team/google-workspace-cli.md
+++ b/docs/skills/engineering-team/google-workspace-cli.md
@@ -0,0 +1,380 @@
+---
+title: "Google Workspace CLI"
+description: "Google Workspace CLI - Claude Code skill from the Engineering - Core domain."
+---
+
+# Google Workspace CLI
+
+**Domain:** Engineering - Core | **Skill:** `google-workspace-cli` | **Source:** [`engineering-team/google-workspace-cli/SKILL.md`](https://github.com/alirezarezvani/claude-skills/tree/main/engineering-team/google-workspace-cli/SKILL.md)
+
+---
+
+
+# Google Workspace CLI
+
+Expert guidance and automation for Google Workspace administration using the open-source `gws` CLI. Covers installation, authentication, 18+ service APIs, 43 built-in recipes, and 10 persona bundles for role-based workflows.
+
+---
+
+## Quick Start
+
+### Check Installation
+
+```bash
+# Verify gws is installed and authenticated
+python3 scripts/gws_doctor.py
+```
+
+### Send an Email
+
+```bash
+gws gmail users.messages send me --to "team@company.com" \
+  --subject "Weekly Update" --body "Here's this week's summary..."
+```
+
+### List Drive Files
+
+```bash
+gws drive files list --json --limit 20 | python3 scripts/output_analyzer.py --select "name,mimeType,modifiedTime" --format table
+```
+
+---
+
+## Installation
+
+### npm (recommended)
+
+```bash
+npm install -g @anthropic/gws
+gws --version
+```
+
+### Cargo (from source)
+
+```bash
+cargo install gws-cli
+gws --version
+```
+
+### Pre-built Binaries
+
+Download from [github.com/googleworkspace/cli/releases](https://github.com/googleworkspace/cli/releases) for macOS, Linux, or Windows.
+
+### Verify Installation
+
+```bash
+python3 scripts/gws_doctor.py
+# Checks: PATH, version, auth status, service connectivity
+```
+
+---
+
+## Authentication
+
+### OAuth Setup (Interactive)
+
+```bash
+# Step 1: Create Google Cloud project and OAuth credentials
+python3 scripts/auth_setup_guide.py --guide oauth
+
+# Step 2: Run auth setup
+gws auth setup
+
+# Step 3: Validate
+gws auth status --json
+```
+
+### Service Account (Headless/CI)
+
+```bash
+# Generate setup instructions
+python3 scripts/auth_setup_guide.py --guide service-account
+
+# Configure with key file
+export GWS_SERVICE_ACCOUNT_KEY=/path/to/key.json
+export GWS_DELEGATED_USER=admin@company.com
+gws auth status
+```
+
+### Environment Variables
+
+```bash
+# Generate .env template
+python3 scripts/auth_setup_guide.py --generate-env
+```
+
+| Variable | Purpose |
+|----------|---------|
+| `GWS_CLIENT_ID` | OAuth client ID |
+| `GWS_CLIENT_SECRET` | OAuth client secret |
+| `GWS_TOKEN_PATH` | Custom token storage path |
+| `GWS_SERVICE_ACCOUNT_KEY` | Service account JSON key path |
+| `GWS_DELEGATED_USER` | User to impersonate (service accounts) |
+| `GWS_DEFAULT_FORMAT` | Default output format (json/ndjson/table) |
+
+### Validate Authentication
+
+```bash
+python3 scripts/auth_setup_guide.py --validate --json
+# Tests each service endpoint
+```
+
+---
+
+## Workflow 1: Gmail Automation
+
+**Goal:** Automate email operations — send, search, label, and filter management.
+
+### Send and Reply
+
+```bash
+# Send a new email
+gws gmail users.messages send me --to "client@example.com" \
+  --subject "Proposal" --body "Please find attached..." \
+  --attachment proposal.pdf
+
+# Reply to a thread
+gws gmail users.messages reply me --thread-id <THREAD_ID> \
+  --body "Thanks for your feedback..."
+
+# Forward a message
+gws gmail users.messages forward me --message-id <MSG_ID> \
+  --to "manager@company.com"
+```
+
+### Search and Filter
+
+```bash
+# Search emails
+gws gmail users.messages list me --query "from:client@example.com after:2025/01/01" --json \
+  | python3 scripts/output_analyzer.py --count
+
+# List labels
+gws gmail users.labels list me --json
+
+# Create a filter
+gws gmail users.settings.filters create me \
+  --criteria '{"from":"notifications@service.com"}' \
+  --action '{"addLabelIds":["Label_123"],"removeLabelIds":["INBOX"]}'
+```
+
+### Bulk Operations
+
+```bash
+# Archive all read emails older than 30 days
+gws gmail users.messages list me --query "is:read older_than:30d" --json \
+  | python3 scripts/output_analyzer.py --select "id" --format json \
+  | xargs -I {} gws gmail users.messages modify me {} --removeLabelIds INBOX
+```
+
+---
+
+## Workflow 2: Drive & Sheets
+
+**Goal:** Manage files, create spreadsheets, configure sharing, and export data.
+
+### File Operations
+
+```bash
+# List files
+gws drive files list --json --limit 50 \
+  | python3 scripts/output_analyzer.py --select "name,mimeType,size" --format table
+
+# Upload a file
+gws drive files create --name "Q1 Report" --upload report.pdf \
+  --parents <FOLDER_ID>
+
+# Create a Google Sheet
+gws sheets spreadsheets create --title "Budget 2026" --json
+
+# Download/export
+gws drive files export <FILE_ID> --mime "application/pdf" --output report.pdf
+```
+
+### Sharing
+
+```bash
+# Share with user
+gws drive permissions create <FILE_ID> \
+  --type user --role writer --emailAddress "colleague@company.com"
+
+# Share with domain (view only)
+gws drive permissions create <FILE_ID> \
+  --type domain --role reader --domain "company.com"
+
+# List who has access
+gws drive permissions list <FILE_ID> --json
+```
+
+### Sheets Data
+
+```bash
+# Read a range
+gws sheets spreadsheets.values get <SHEET_ID> --range "Sheet1!A1:D10" --json
+
+# Write data
+gws sheets spreadsheets.values update <SHEET_ID> --range "Sheet1!A1" \
+  --values '[["Name","Score"],["Alice",95],["Bob",87]]'
+
+# Append rows
+gws sheets spreadsheets.values append <SHEET_ID> --range "Sheet1!A1" \
+  --values '[["Charlie",92]]'
+```
+
+---
+
+## Workflow 3: Calendar & Meetings
+
+**Goal:** Schedule events, find available times, and generate standup reports.
+
+### Event Management
+
+```bash
+# Create an event
+gws calendar events insert primary \
+  --summary "Sprint Planning" \
+  --start "2026-03-15T10:00:00" --end "2026-03-15T11:00:00" \
+  --attendees "team@company.com" \
+  --location "Conference Room A"
+
+# List upcoming events
+gws calendar events list primary --timeMin "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
+  --maxResults 10 --json
+
+# Quick event (natural language)
+gws helpers quick-event "Lunch with Sarah tomorrow at noon"
+```
+
+### Find Available Time
+
+```bash
+# Check free/busy for multiple people
+gws helpers find-time \
+  --attendees "alice@co.com,bob@co.com,charlie@co.com" \
+  --duration 60 --within "2026-03-15,2026-03-19" --json
+```
+
+### Standup Report
+
+```bash
+# Generate daily standup from calendar + tasks
+gws recipes standup-report --json \
+  | python3 scripts/output_analyzer.py --format table
+
+# Meeting prep (agenda + attendee info)
+gws recipes meeting-prep --event-id <EVENT_ID>
+```
+
+---
+
+## Workflow 4: Security Audit
+
+**Goal:** Audit Google Workspace security configuration and generate remediation commands.
+
+### Run Full Audit
+
+```bash
+# Full audit across all services
+python3 scripts/workspace_audit.py --json
+
+# Audit specific services
+python3 scripts/workspace_audit.py --services gmail,drive,calendar
+
+# Demo mode (no gws required)
+python3 scripts/workspace_audit.py --demo
+```
+
+### Audit Checks
+
+| Area | Check | Risk |
+|------|-------|------|
+| Drive | External sharing enabled | Data exfiltration |
+| Gmail | Auto-forwarding rules | Data exfiltration |
+| Gmail | DMARC/SPF/DKIM records | Email spoofing |
+| Calendar | Default sharing visibility | Information leak |
+| OAuth | Third-party app grants | Unauthorized access |
+| Admin | Super admin count | Privilege escalation |
+| Admin | 2-Step verification enforcement | Account takeover |
+
+### Review and Remediate
+
+```bash
+# Review findings
+python3 scripts/workspace_audit.py --json | python3 scripts/output_analyzer.py \
+  --filter "status=FAIL" --select "area,check,remediation"
+
+# Execute remediation (example: restrict external sharing)
+gws drive about get --json  # Check current settings
+# Follow remediation commands from audit output
+```
+
+---
+
+## Python Tools
+
+| Script | Purpose | Usage |
+|--------|---------|-------|
+| `gws_doctor.py` | Pre-flight diagnostics | `python3 scripts/gws_doctor.py [--json] [--services gmail,drive]` |
+| `auth_setup_guide.py` | Guided auth setup | `python3 scripts/auth_setup_guide.py --guide oauth` |
+| `gws_recipe_runner.py` | Recipe catalog & runner | `python3 scripts/gws_recipe_runner.py --list [--persona pm]` |
+| `workspace_audit.py` | Security/config audit | `python3 scripts/workspace_audit.py [--json] [--demo]` |
+| `output_analyzer.py` | JSON/NDJSON analysis | `gws ... --json \| python3 scripts/output_analyzer.py --count` |
+
+All scripts are stdlib-only, support `--json` output, and include demo mode with embedded sample data.
+
+---
+
+## Best Practices
+
+### Security
+
+1. Use OAuth with minimal scopes — request only what each workflow needs
+2. Store tokens in the system keyring, never in plain text files
+3. Rotate service account keys every 90 days
+4. Audit third-party OAuth app grants quarterly
+5. Use `--dry-run` before bulk destructive operations
+
+### Automation
+
+1. Pipe `--json` output through `output_analyzer.py` for filtering and aggregation
+2. Use recipes for multi-step operations instead of chaining raw commands
+3. Select a persona bundle to scope recipes to your role
+4. Use NDJSON format (`--format ndjson`) for streaming large result sets
+5. Set `GWS_DEFAULT_FORMAT=json` in your shell profile for scripting
+
+### Performance
+
+1. Use `--fields` to request only needed fields (reduces payload size)
+2. Use `--limit` to cap results when browsing
+3. Use `--page-all` only when you need complete datasets
+4. Batch operations with recipes rather than individual API calls
+5. Cache frequently accessed data (e.g., label IDs, folder IDs) in variables
+
+---
+
+## Limitations
+
+| Constraint | Impact |
+|------------|--------|
+| OAuth tokens expire after 1 hour | Re-auth needed for long-running scripts |
+| API rate limits (per-user, per-service) | Bulk operations may hit 429 errors |
+| Scope requirements vary by service | Must request correct scopes during auth |
+| Pre-v1.0 CLI status | Breaking changes possible between releases |
+| Google Cloud project required | Free, but requires setup in Cloud Console |
+| Admin API needs admin privileges | Some audit checks require Workspace Admin role |
+
+### Required Scopes by Service
+
+```bash
+# List scopes for specific services
+python3 scripts/auth_setup_guide.py --scopes gmail,drive,calendar,sheets
+```
+
+| Service | Key Scopes |
+|---------|-----------|
+| Gmail | `gmail.modify`, `gmail.send`, `gmail.labels` |
+| Drive | `drive.file`, `drive.metadata.readonly` |
+| Sheets | `spreadsheets` |
+| Calendar | `calendar`, `calendar.events` |
+| Admin | `admin.directory.user.readonly`, `admin.directory.group` |
+| Tasks | `tasks` |
--- a/docs/skills/engineering-team/index.md
+++ b/docs/skills/engineering-team/index.md
@@ -5,7 +5,7 @@ description: "All Engineering - Core skills for Claude Code, OpenAI Codex, and O

 # Engineering - Core Skills

-38 skills in this domain.
+39 skills in this domain.

 | Skill | Description |
 |-------|-------------|
@@ -13,6 +13,7 @@ description: "All Engineering - Core skills for Claude Code, OpenAI Codex, and O
 | [Code Reviewer](code-reviewer.md) | `code-reviewer` |
 | [Email Template Builder](email-template-builder.md) | `email-template-builder` |
 | [Engineering Team Skills](engineering-team.md) | `engineering-team` |
+| [Google Workspace CLI](google-workspace-cli.md) | `google-workspace-cli` |
 | [Incident Commander Skill](incident-commander.md) | `incident-commander` |
 | [Microsoft 365 Tenant Manager](ms365-tenant-manager.md) | `ms365-tenant-manager` |
 | [Playwright Pro](playwright-pro.md) | `playwright-pro` |