Tmp

This package largely looks like the open-source gogcli CLI (Homebrew formula + source files) — installing that CLI via the referenced Homebrew tap is consistent with the skill's top-level purpose. However, the bundled gmail documentation also describes using a Maton-managed gateway and asks you to set MATON_API_KEY and call maton.ai endpoints. That is not declared in the skill's top-level requirements and would route Google API calls (and effectively your access tokens) through a third party. Before installing or providing any API key: - Decide whether you want a local OAuth flow (gog auth credentials + gog auth add) or to use a managed gateway. If you want local-only, ignore MATON_API_KEY and follow the gog auth instructions. - Do NOT set MATON_API_KEY or paste secrets unless you trust maton.ai. Verify the Maton service, its privacy/security policies, and whether you intended to delegate API traffic to that provider. - Confirm the Homebrew tap origin: brew tap steipete/tap is cited; verify the tap points to the expected GitHub repo (steipete/gogcli) and the formula's URL/sha256 before installing. - The package metadata/slug (Tmp) and included _meta.json differ from the registry metadata; this mismatch is a red flag — confirm the publisher identity and that you pulled the package from a trusted source. - If you need stricter isolation, install and run the CLI in a disposable environment (VM/container) and inspect network traffic, or build from source after reviewing the repository on GitHub. If you want, I can: list the specific lines in gmail/SKILL.md that reference MATON_API_KEY and maton.ai, or help craft a safe installation checklist (brew tap verification and building from source).