Google Workspace CLI (gog)

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 4:44 AM UTC
• Version: 1.0.1

Overview

This skill is a straightforward guide for using a Google Workspace CLI, with sensitive OAuth access that is disclosed and user-directed.

Install this only if you trust the gog CLI and its Homebrew tap. During OAuth setup, authorize the minimum Google services needed, and be careful with commands that send email, create events, or update, append, or clear spreadsheet data.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:7

Finding

Unpinned Third-Party Homebrew Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 7
Vulnerability Type: Supply-chain risk from a mutable third-party package source
Risk Level: Medium

Complete Code Snippet:

yaml

metadata: {"clawdbot":{"emoji":"🎮","requires":{"bins":["gog"],"install":[{"id":"brew","kind":"brew","formula":"steipete/tap/gogcli","bins":["gog"],"label":"Install gog (brew)"}]}}}

Technical Analysis

The skill directs the environment to install gogcli from the third-party Homebrew tap steipete/tap. The dependency declaration does not pin an immutable release, formula revision, source commit, or artifact checksum. Consequently, the code installed in the future can differ from what existed when this skill was reviewed.

Because the project contains no local implementation of the CLI, its effective behavior cannot be verified from the audited package. If the external tap, formula, upstream release process, or referenced artifact is compromised, a modified dependency could execute attacker-controlled code during installation or later CLI invocation.

This risk is amplified by the documented workflow, which asks users to authorize the installed CLI for Gmail, Calendar, Drive, Contacts, Sheets, and Docs.

Attack Path

1. An attacker compromises the third-party Homebrew tap, its maintainer account, the upstream release channel, or an artifact referenced by the formula.
2. The attacker modifies the formula or distributed artifact to install a malicious gog executable or run malicious installation logic.
3. The skill installation process resolves the mutable steipete/tap/gogcli dependency without validating a project-declared immutable version or checksum.
4. The user follows the documented setup and supplies OAuth client credentials or authorizes one or more Google Workspace services.
5. The compromised executable runs with the invoking user's local privileges and may misuse the OAuth authorization available to ...[truncated 932 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to an immutable, reviewed release rather than relying only on the mutable formula name.
2. Verify downloaded artifacts with a cryptographic checksum or signature tied to the pinned release.
3. Record the authoritative upstream repository and expected release provenance in the skill metadata or documentation.
4. Prefer a vendor-controlled, reproducible distribution channel where available, and review the Homebrew formula before enabling automated installation.
5. Add dependency monitoring so formula ownership, source URLs, checksums, and release signatures are revalidated when versions change.
6. Apply least privilege to OAuth authorization: request only the specific Google Workspace services and scopes required for the intended task.
7. Store OAuth credentials in an operating-system credential store with restrictive permissions, and document procedures for reviewing and revoking granted access.
8. In managed environments, install an independently verified binary through an approved internal package repository.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

md

Use `gog` for Gmail/Calendar/Drive/Contacts/Sheets/Docs. Requires OAuth setup.

Setup (once)
- `gog auth credentials /path/to/client_secret.json`
- `gog auth add [e-mail] --services gmail,calendar,drive,contacts,sheets,docs`
- `gog auth list`

Static analysis

No suspicious patterns detected.