GoG CLI Complete

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:09 AM UTC
• Version: 1.0.3

Overview

The skill is a disclosed Google Workspace CLI helper, but it combines broad email, Drive, admin, credential, webhook, and tracking capabilities with under-scoped safety guidance and an unpinned third-party install.

Install only if you trust the gog CLI source and are prepared to grant it Google Workspace access. Use the narrowest OAuth scopes, avoid --force and --no-input for sensitive actions, do not pass tokens on command lines, review webhook/tracking destinations carefully, and require explicit approval for admin, sharing, forwarding, delegation, tracking, and deletion operations.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:9

Finding

Unpinned CLI Installation from a Third-Party Homebrew Tap

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:164

Finding

OAuth Bearer Token Passed Through Process Command-Line Arguments

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:300

Finding

Privacy-Sensitive Gmail Webhooks and Email Tracking Lack Explicit Safety Confirmation

Content

View full analysis

/topics/ --label INBOX gog gmail watch serve --bind 127.0.0.1 --token --hook-url gog gmail watch serve --bind 0.0.0.0 --verify-oidc --oidc-email --hook-url gog gmail watch serve --bind 127.0.0.1 --token --fetch-delay 5 --hook-url gog gmail watch serve --bind 127.0.0.1 --token --exclude-labels SPAM,TRASH --hook-url gog gmail history --since ``` ```bash ### Email Tracking gog gmail track setup --worker-url https://gog-email-tracker..workers.dev gog gmail send --to [e-mail] --subject "Hello" --body-html "

Hi!

" --track gog gmail track opens gog gmail track opens --to [e-mail] gog gmail track status ``` The relevant Agent safety rule is narrower than these operations: ```markdown - Always confirm before sending mail, creating events, or deleting anything. ``` A similar rule appears near the end of the file: ```markdown - Always confirm before sending mail, creating events, or deleting resources. ``` ### Technical Analysis The Gmail watch examples permit event delivery to an arbitrary `--hook-url`. One example also binds the watch service to `0.0.0.0`, making the listener reachable through every available network interface, subject to host and network firewall rules. The tracking feature configures an external worker URL and embeds email-open tracking in outgoing HTML messages. Open tracking communicates recipient interaction metadata to the configured tracking service. Although network communication is expected for a Google Workspace CLI, these operations have privacy and exposure implications beyond ordinary mailbox retrieval. The Skill requires confirmation before send ...[truncated 2336 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (12)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · OLD-SKILL.md (reported line 13)May include surrounding context.

md

Use `gog` for Gmail/Calendar/Drive/Contacts/Sheets/Docs. Requires OAuth setup.

Setup (once)
- `gog auth credentials /path/to/client_secret.json`
- `gog auth add [e-mail] --services gmail,calendar,drive,contacts,sheets,docs`
- `gog auth list`

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

md

Use `gog` for Gmail/Calendar/Drive/Contacts/Sheets/Docs. Requires OAuth setup.

Setup (once)
- `gog auth credentials /path/to/client_secret.json`
- `gog auth add [e-mail] --services gmail,calendar,drive,contacts,sheets,docs`
- `gog auth list`

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 1)May include surrounding context.

md

---
name: gog-complete
description: "Google Workspace CLI for Gmail, Calendar, Chat, Classroom, Drive, Docs, Slides, Sheets, Forms, Apps Script, Contacts, Tasks, People, Admin, Groups, and Keep."
homepage: https://gogcli.sh

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 131)May include surrounding context.

md

## Environment Variables

- `GOG_ACCOUNT` — Default account
- `GOG_ACCESS_TOKEN` — Direct access token (CI; ~1h, no refresh)
- `GOG_CLIENT` — OAuth client name
- `GOG_JSON` / `GOG_PLAIN` — Default output format
- `GOG_COLOR` — Color mode

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 164)May include surrounding context.

md

## Environment Variables

- `GOG_ACCOUNT` — Default account
- `GOG_ACCESS_TOKEN` — Direct access token (CI; ~1h, no refresh)
- `GOG_CLIENT` — OAuth client name
- `GOG_JSON` / `GOG_PLAIN` — Default output format
- `GOG_COLOR` — Color mode

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 173)May include surrounding context.

md

gog auth service-account unset <email>
gog auth keep <email> --key <path>

# Keyring
gog auth keyring
gog auth keyring file|keychain|auto

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 174)May include surrounding context.

md

gog auth keep <email> --key <path>

# Keyring
gog auth keyring
gog auth keyring file|keychain|auto

# Management

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 175)May include surrounding context.

md

gog auth keep <email> --key <path>

# Keyring
gog auth keyring
gog auth keyring file|keychain|auto

# Management

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 175)May include surrounding context.

md

# Keyring
gog auth keyring
gog auth keyring file|keychain|auto

# Management
gog auth list

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.

md

- `--results-only` — JSON mode: emit only primary result (drops nextPageToken etc.)
- `--select <fields>` — JSON mode: select comma-separated fields (dot paths supported)
- `-n, --dry-run` — Do not make changes; print intended actions and exit
- `-y, --force` — Skip confirmations
- `--no-input` — Never prompt (CI/agent mode)
- `-v, --verbose` — Debug logging
- `--color <auto|always|never>`

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill explicitly documents email open tracking (--track) and tracking status commands but does not include any privacy, consent, or policy warning. In an agent context, this can normalize covert recipient monitoring and lead to unauthorized surveillance or compliance violations, especially if an operator is unaware that tracking pixels are being inserted into outbound mail.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 754)May include surrounding context.

bash

# Lists
gog tasks lists --max 50
gog tasks lists create <title>

# Tasks
gog tasks list <tasklistId> --max 50

Static analysis

No suspicious patterns detected.