Gog Cli

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:36 AM UTC
• Version: 1.0.0

Overview

This Google Workspace CLI skill is mostly purpose-aligned, but it needs review because it combines broad OAuth-backed Workspace access with an unsafe command template and an unpinned third-party CLI install.

Install only if you trust the `gogcli` Homebrew source and are comfortable granting Google Workspace OAuth access. Replace the sample account with your own, limit OAuth services where possible, verify Gmail message IDs and Sheet ranges before use, and require confirmation for mail sends, calendar changes, and Sheets clear/update operations.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: skill.json:13

Finding

Command Injection Through an Unquoted Message ID Template

Content

View full analysis

Vulnerability Details

File Location: skill.json, line 13
Vulnerability Type: OS command injection through unsafe template interpolation
Risk Level: High

Vulnerable Code:

json

"command": "gog gmail read --id {{id}}"

Technical Analysis

The id parameter is inserted directly into a command string without quoting, escaping, or documented format validation. If the skill runtime performs textual substitution and passes the resulting string to a shell, an attacker-controlled value containing shell metacharacters can terminate or extend the intended gog command.

For example, a value conceptually shaped like valid-id; attacker-command could cause the shell to execute both the expected Gmail operation and an additional command. The exact payload syntax depends on the shell and the tool runner's command-execution semantics.

Attack Path

1. An attacker causes an untrusted or attacker-controlled value to be supplied as the id argument to gmail_read.
2. The runtime substitutes that value into gog gmail read --id {{id}}.
3. If the resulting command is evaluated through a shell, metacharacters in the value alter the command structure.
4. The injected command executes with the operating-system permissions and environment inherited from the Agent process.
5. The injected process may access local files, environment variables, OAuth material, or network resources available to that process.

Impact Assessment

Successful exploitation could provide arbitrary command execution under the Agent process account. The resulting scope is bounded by that account's local permissions, sandbox restrictions, available credentials, and network access. Because this skill is intended to access Google Workspace, a compromised process may also be able to reach locally stored OAuth credentials or invoke authenticated Workspace operations available to the configured gog account.

Remediation

View remediation

Remediation Suggestions

• Do not construct commands through string interpolation or invoke them through a shell.
• Define the executable and arguments separately, such as an argument array equivalent to ["gog", "gmail", "read", "--id", id].
• Validate id against the exact Gmail message-ID syntax expected by gog, rejecting whitespace, control characters, shell metacharacters, option prefixes, and values outside reasonable length limits.
• If the framework only supports command strings, apply a framework-approved shell-escaping function after validation; quoting alone should not be treated as the primary control.
• Add tests using values containing semicolons, command substitutions, quotes, newlines, and leading hyphens to verify that they are rejected or passed strictly as one literal argument.
• Run the skill with least privilege and isolate Workspace credentials from unrelated subprocesses.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:7

Finding

Unpinned Installation from a Third-Party Homebrew Tap

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 7
Vulnerability Type: Unpinned third-party supply-chain dependency
Risk Level: Medium

Vulnerable Code:

yaml

metadata: {"clawdbot":{"emoji":"🎮","requires":{"bins":["gog"],"install":[{"id":"brew","kind":"brew","formula":"steipete/tap/gogcli","bins":["gog"],"label":"Install gog (brew)"}]}}}

Technical Analysis

The installation metadata obtains gogcli from the third-party Homebrew tap steipete/tap without pinning a reviewed release or cryptographic digest. Consequently, the code installed in the future can differ from the version that was assessed with this skill.

This creates a supply-chain trust boundary: compromise of the tap, its publishing credentials, the formula repository, or a referenced release artifact could replace the expected dependency with malicious content. Homebrew installation can execute package build or installation logic, and the installed binary later receives access to the user's Google Workspace OAuth context.

Attack Path

1. An attacker compromises the third-party tap, its maintainer account, its distribution infrastructure, or an artifact referenced by the formula.
2. The attacker publishes a modified formula or package under the expected steipete/tap/gogcli name.
3. A user installs the skill dependency using the unpinned metadata.
4. Homebrew retrieves and installs the attacker-controlled version.
5. Malicious logic executes during installation or when the Agent invokes gog.
6. That logic operates with the installing or Agent user's privileges and may access files, environment data, network resources, or OAuth credentials available in that context.

Impact Assessment

Exploitation could execute arbitrary code with the privileges of the user performing the installation or running gog. Potential scope includes local user data, Agent-accessible secrets, and Google Workspace resources authorized thr ...[truncated 228 chars]

Remediation

View remediation

Remediation Suggestions

• Prefer a verified official distribution source with documented ownership and release-signing practices.
• Pin installation to a specifically reviewed release rather than a mutable formula reference.
• Verify downloaded artifacts using a trusted SHA-256 digest or cryptographic signature before installation.
• Record the approved dependency version and integrity value in machine-readable metadata.
• Use dependency monitoring and require security review before updating the pinned version or digest.
• Where supported, install in a restricted environment and run gog with only the filesystem, network, and credential access required for the requested Workspace operation.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

md

Use `gog` for Gmail/Calendar/Drive/Contacts/Sheets/Docs. Requires OAuth setup.

Setup (once)
- `gog auth credentials /path/to/client_secret.json`
- `gog auth add [e-mail] --services gmail,calendar,drive,contacts,sheets,docs`
- `gog auth list`

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill documents a destructive gog sheets clear operation without any warning that it irreversibly removes spreadsheet data from the specified range. In an agent/automation context, users may copy commands directly, increasing the chance of accidental data loss if the range or sheet ID is wrong.

Content

No source excerpt is available for this finding.