Gog 1

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed helper for using a Google Workspace CLI; it needs broad OAuth access, but the behavior shown is expected for that purpose.

Install only if you trust the Homebrew tap and the gog CLI. Review the Google OAuth consent scopes, use the least-privileged account practical, confirm email sends, calendar changes, and Sheets updates or clears before running them, and revoke the OAuth token when you no longer need access.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Credential Access

High
Category
Privilege Escalation
Content
Use `gog` for Gmail/Calendar/Drive/Contacts/Sheets/Docs. Requires OAuth setup.

Setup (once)
- `gog auth credentials /path/to/client_secret.json`
- `gog auth add you@gmail.com --services gmail,calendar,drive,contacts,sheets,docs`
- `gog auth list`
Confidence
70% confidence
Finding
secret.json

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal