Backup Gog 20260213 121122
WarnAudited by ClawScan on May 10, 2026.
Overview
This is a coherent Google Workspace CLI skill, but it asks for broad Google OAuth access and exposes commands that can send or modify account data, so it needs careful review before connecting an account.
Install only if you trust the `gog` CLI source. Connect the smallest set of Google services needed, use a limited account when possible, require explicit approval for sends and data-changing commands, and revoke OAuth access when finished.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If connected, the CLI and any agent using it may be able to access substantial Gmail, Drive, Contacts, Docs, Sheets, and Calendar data for the selected account.
The skill directs the user to grant OAuth access to multiple Google Workspace services under a Google account, which is broad delegated authority.
`gog auth credentials /path/to/client_secret.json` ... `gog auth add you@gmail.com --services gmail,calendar,drive,contacts,sheets,docs`
Use the least-privilege service set needed for the task, prefer a dedicated or limited Google account where possible, and review/revoke OAuth access after use.
A mistaken or overly autonomous invocation could send messages or change Google Workspace data.
The documented commands include actions that can send email and modify or clear Sheets data, and the scripting guidance could reduce interactive checks.
`gog gmail send ...`; `gog sheets update ...`; `gog sheets append ...`; `gog sheets clear ...`; `For scripting, prefer --json plus --no-input.`
Require explicit user approval for mail sends, calendar writes, Sheets updates/appends/clears, and other account-changing actions; avoid `--no-input` for mutations unless the exact action was approved.
The local `gog` binary will handle Google OAuth tokens and account data, so its upstream source needs to be trusted separately from this instruction file.
The actual executable is installed from an external Homebrew tap and was not included in the reviewed skill files.
brew | formula: steipete/tap/gogcli | creates binaries: gog
Verify the Homebrew tap and project provenance before installing, and keep the binary updated from a trusted source.