asdasdsad
v1.0.0Google Workspace CLI for Gmail, Calendar, Drive, Contacts, Sheets, and Docs.
⭐ 0· 560·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description match the actual requirements and instructions: the skill requires the 'gog' CLI and the SKILL.md shows commands for Gmail, Calendar, Drive, Contacts, Sheets, and Docs. There are no unrelated binaries or unexplained capabilities requested.
Instruction Scope
SKILL.md limits runtime actions to using the 'gog' CLI and Google OAuth flows (gog auth credentials, gog auth add, various gog commands). It does not instruct reading unrelated system files or exfiltrating data. It does, however, expect you to supply an OAuth client_secret.json path and will perform actions that can access/send your Google data (e.g., sending email), so those scopes warrant review.
Install Mechanism
Install is via Homebrew formula steipete/tap/gogcli which creates the 'gog' binary. Using a third‑party tap is a moderate risk compared with an official formula or verified GitHub release — you should review the tap/formula source before installing.
Credentials
Registry metadata declares no required env vars, but the SKILL.md expects OAuth client credentials (client_secret.json) and mentions GOG_ACCOUNT. The skill will obtain OAuth tokens and access your Google account(s) (including sending mail). The credential/config handling is not declared explicitly in requires.env or required config paths — this mismatch should be clarified.
Persistence & Privilege
Skill is not marked always:true and does not request system-wide configuration changes. Installing the brew formula will place a binary on disk (normal for a CLI). The skill does not declare elevated or persistent platform privileges beyond standard CLI install.
What to consider before installing
This skill appears to be what it says (a Google Workspace CLI helper) but take these precautions before installing:
- Verify the Homebrew tap/formula (steipete/tap/gogcli): inspect the tap/formula source or prefer an official/known release to avoid running unexpected code from a third‑party tap.
- Understand OAuth: the SKILL.md expects a client_secret.json and will request OAuth scopes that can read/send mail and modify Drive/Calendar/Sheets. Only use an account you trust and review which scopes are requested.
- Review where tokens/config are stored: the CLI will likely save OAuth tokens locally; confirm the storage location and remove tokens when no longer needed.
- Be cautious with mail/calendar operations: the CLI can send email or create events — require explicit confirmation and avoid granting it access to your primary account if you can test with a limited or throwaway account first.
- If you want stronger assurance, ask the publisher for a canonical source code repo or signed release and review it before installing.
Confidence in this assessment is medium because the skill is instruction-only and coherent overall, but the undeclared OAuth credential expectations and use of a third‑party brew tap are notable mismatches that merit manual review.Like a lobster shell, security has layers — review code before you run it.
latestvk9705x3zqz44ftga7jdrgkhxmn81j5vd
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🎮 Clawdis
Binsgog
Install
Install gog (brew)
Bins: gog
brew install steipete/tap/gogcli