GoG-ifocus

Google Workspace CLI for Gmail, Calendar, Drive, Contacts, Sheets, and Docs.

Security Scan

The skill appears to be a straightforward Google Workspace CLI wrapper, but packaging and minor instruction inconsistencies (metadata mismatches, an undeclared env var, and a third‑party brew tap) leave important questions unanswered.

Purpose & Capability

The SKILL.md describes a Google Workspace CLI and the skill requires the 'gog' binary and provides a brew install for it — this aligns with the stated purpose. However the included _meta.json metadata (ownerId, slug, version) does not match the registry metadata for this package, which is an incoherence in packaging/ownership that should be explained.

Instruction Scope

Instructions are narrowly scoped to using the 'gog' CLI (auth setup, Gmail/Calendar/Drive/Sheets/Docs commands). They do require the user to supply OAuth client_secret.json and suggest using '--no-input' for scripting; that enables non-interactive operations (sending mail/creating events) which could be executed by an autonomous agent. The SKILL.md also references the GOG_ACCOUNT env var even though no env vars are declared.

Install Mechanism

The install uses a Homebrew formula (steipete/tap/gogcli) which is a lower-risk, common mechanism but is a third-party tap. That is traceable but worth verifying (brew taps can run install scripts and point to arbitrary upstream code). No arbitrary URL downloads or archive extraction are present in the manifest.

Credentials

No required environment variables are declared, and no primary credential is listed — that's broadly consistent. But SKILL.md references GOG_ACCOUNT (not declared) and instructs storing/using a client_secret.json (sensitive OAuth client credentials). Requesting OAuth credentials and a local credentials file is reasonable for this CLI, but the skill does not declare these as required fields in metadata and the handling of those secrets is not described.

Persistence & Privilege

always is false, the skill is user-invocable and can be called autonomously (the platform default). The skill does not request persistent system-wide privileges or config paths. No signs it modifies other skills or global agent settings.

What to consider before installing

This skill is generally coherent with a Google Workspace CLI, but before installing you should: 1) verify the Homebrew tap (steipete/tap) and the upstream project (check the brew formula and the project's repo/release) to confirm the binary's provenance; 2) confirm the author/owner metadata mismatch (_meta.json vs registry metadata) — ask the publisher to explain and correct it; 3) be cautious about supplying OAuth client_secret.json and any account credentials — only use credentials you trust and consider using limited-scope credentials; 4) be aware that the SKILL.md recommends non-interactive flags (--no-input), which could let an agent send email or create calendar events without extra confirmation; if you want to avoid that, require interactive confirmation or restrict agent autonomy for this skill; and 5) if you need higher assurance, inspect the installed 'gog' binary (or build from source) before granting it access to your Google account.

gog

Use gog for Gmail/Calendar/Drive/Contacts/Sheets/Docs. Requires OAuth setup.

Setup (once)

• gog auth credentials /path/to/client_secret.json
• gog auth add [e-mail] --services gmail,calendar,drive,contacts,sheets,docs
• gog auth list

Common commands

• Gmail search: gog gmail search 'newer_than:7d' --max 10
• Gmail send: gog gmail send --to [e-mail] --subject "Hi" --body "Hello"
• Calendar: gog calendar events <calendarId> --from <iso> --to <iso>
• Drive search: gog drive search "query" --max 10
• Contacts: gog contacts list --max 20
• Sheets get: gog sheets get <sheetId> "Tab!A1:D10" --json
• Sheets update: gog sheets update <sheetId> "Tab!A1:B2" --values-json '[["A","B"],["1","2"]]' --input USER_ENTERED
• Sheets append: gog sheets append <sheetId> "Tab!A:C" --values-json '[["x","y","z"]]' --insert INSERT_ROWS
• Sheets clear: gog sheets clear <sheetId> "Tab!A2:Z"
• Sheets metadata: gog sheets metadata <sheetId> --json
• Docs export: gog docs export <docId> --format txt --out /tmp/doc.txt
• Docs cat: gog docs cat <docId>

Notes

• Set GOG_ACCOUNT=[e-mail] to avoid repeating --account.
• For scripting, prefer --json plus --no-input.
• Sheets values can be passed via --values-json (recommended) or as inline rows.
• Docs supports export/cat/copy. In-place edits require a Docs API client (not in gog).
• Confirm before sending mail or creating events.