Gog.Local.Backup

PassAudited by VirusTotal on May 11, 2026.

Overview

Type: OpenClaw Skill Name: gog-local-backup Version: 1.0.0 The skill bundle provides a legitimate interface for the 'gog' CLI tool, which facilitates interactions with Google Workspace services like Gmail, Drive, and Sheets. The installation process uses a standard Homebrew tap (steipete/tap/gogcli), and the documentation (SKILL.md) contains only standard command usage and setup instructions without any evidence of malicious intent, data exfiltration, or prompt injection.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI03: Identity and Privilege Abuse

What this means

If authorized, the CLI can access data from the selected Google account across Gmail, Calendar, Drive, Contacts, Sheets, and Docs.

Why it was flagged

The setup grants delegated OAuth access to multiple Google Workspace services. This is expected for the stated CLI purpose, but it is broad account authority.

Skill content

`gog auth add you@gmail.com --services gmail,calendar,drive,contacts,sheets,docs`

Recommendation

Review the OAuth scopes during setup, use the least-privileged account and services needed, and revoke access when the skill is no longer needed.

Note

ASI02: Tool Misuse and Exploitation

What this means

An agent using this skill could send email or modify Google Sheets when authorized by the user and account permissions.

Why it was flagged

The documented examples include actions that can send messages or change spreadsheet data. They are purpose-aligned, but they have real user impact if run unintentionally.

Skill content

`gog gmail send ...`; `gog sheets update ...`; `gog sheets append ...`; `gog sheets clear ...`

Recommendation

Require explicit user confirmation before any send, create, update, append, clear, or other write operation, especially in automated or scripted use.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

The installed `gog` binary will handle OAuth-authorized Google Workspace operations, so its provenance matters.

Why it was flagged

The skill relies on an externally installed Homebrew formula for the executable. This is normal for a CLI integration, but the binary itself is not included in the provided artifacts.

Skill content

brew | formula: steipete/tap/gogcli | creates binaries: gog

Recommendation

Verify the Homebrew tap, project homepage, and package source before granting OAuth access.