Gog.Local.Backup

ReviewAudited by ClawScan on May 1, 2026.

Overview

This is a coherent Google Workspace CLI wrapper, but it requires trusting an external `gog` binary with OAuth access that can read and change Google Workspace data.

Install only if you intend to give `gog` OAuth access to your Google Workspace account. Verify the external Homebrew package first, authorize only the services you need, and require confirmation before any action that sends email, creates calendar items, or changes spreadsheet or document data.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

If authorized, the CLI can access data from the selected Google account across Gmail, Calendar, Drive, Contacts, Sheets, and Docs.

Why it was flagged

The setup grants delegated OAuth access to multiple Google Workspace services. This is expected for the stated CLI purpose, but it is broad account authority.

Skill content
`gog auth add you@gmail.com --services gmail,calendar,drive,contacts,sheets,docs`
Recommendation

Review the OAuth scopes during setup, use the least-privileged account and services needed, and revoke access when the skill is no longer needed.

What this means

An agent using this skill could send email or modify Google Sheets when authorized by the user and account permissions.

Why it was flagged

The documented examples include actions that can send messages or change spreadsheet data. They are purpose-aligned, but they have real user impact if run unintentionally.

Skill content
`gog gmail send ...`; `gog sheets update ...`; `gog sheets append ...`; `gog sheets clear ...`
Recommendation

Require explicit user confirmation before any send, create, update, append, clear, or other write operation, especially in automated or scripted use.

What this means

The installed `gog` binary will handle OAuth-authorized Google Workspace operations, so its provenance matters.

Why it was flagged

The skill relies on an externally installed Homebrew formula for the executable. This is normal for a CLI integration, but the binary itself is not included in the provided artifacts.

Skill content
brew | formula: steipete/tap/gogcli | creates binaries: gog
Recommendation

Verify the Homebrew tap, project homepage, and package source before granting OAuth access.