Gog 1.0.0

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:34 AM UTC
• Version: 1.0.0

Overview

This skill is coherent for using a Google Workspace CLI, but it asks users to install an unpinned third-party tool and grant broad OAuth access to sensitive Google data.

Review the gog CLI source and Homebrew formula before installing, grant only the Google services you actually need, keep client_secret.json out of source control and shared folders, and revoke OAuth tokens if the CLI or credentials may have been exposed. Use a separate Google account or restricted workspace where practical.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:5

Finding

Unpinned Third-Party Homebrew Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 5
Vulnerability Type: Supply-chain risk from an unpinned third-party package source
Risk Level: Medium

Vulnerable Code Snippet:

yaml

metadata: {"clawdbot":{"emoji":"🎮","requires":{"bins":["gog"]},"install":[{"id":"brew","kind":"brew","formula":"steipete/tap/gogcli","bins":["gog"],"label":"Install gog (brew)"}]}}

Technical Analysis

The skill directs users to install gogcli from the third-party Homebrew tap steipete/tap without specifying an immutable version, commit, checksum, or signature. Consequently, the package and its installation behavior may change after the skill has been reviewed.

Homebrew formula installation can execute package-controlled installation logic. If the tap, formula, upstream release process, or maintainer account is compromised, a later installation or upgrade could introduce malicious code. There is no evidence in the audited files that the current dependency is malicious; the finding concerns the absence of dependency pinning and integrity controls.

This risk is particularly relevant because the installed gog executable is subsequently authorized through OAuth to access Gmail, Calendar, Drive, Contacts, Sheets, and Docs.

Attack Path

1. An attacker compromises the third-party Homebrew tap, its maintainer account, the referenced upstream artifacts, or the associated release pipeline.
2. The attacker publishes a malicious or tampered formula or package under the expected gogcli identity.
3. A user follows the skill installation metadata or later upgrades the unpinned package.
4. Homebrew retrieves and installs the attacker-controlled version.
5. Malicious installation or runtime code executes with the privileges of the user running Homebrew.
6. If the compromised CLI is used after OAuth configuration, it may access locally available OAuth credentials or act through the authorized Google Workspace perm ...[truncated 467 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the Homebrew dependency to a reviewed, immutable release or repository commit rather than relying on the latest state of the tap.
• Verify downloaded release artifacts using a trusted cryptographic checksum or signature.
• Document the authoritative source repository and expected publisher identity so users can validate the package origin.
• Prefer a trusted package distribution channel that provides immutable, reproducible, and signed artifacts.
• Review formula changes before upgrades and avoid unattended upgrades for a CLI that handles high-value OAuth credentials.
• Grant only the Google Workspace OAuth scopes required for the intended task, and use separate accounts or restricted environments where practical.
• Store OAuth credentials using platform-protected credential storage and revoke tokens promptly if package compromise is suspected.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md

Use `gog` for Gmail/Calendar/Drive/Contacts/Sheets/Docs. Requires OAuth setup.

Setup (once)
- `gog auth credentials /path/to/client_secret.json`
- `gog auth add [e-mail] --services gmail,calendar,drive,contacts,sheets,docs`
- `gog auth list`

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill instructs users to provide an OAuth client secret file but gives no warning about treating that file as sensitive, avoiding source control, or limiting filesystem exposure. In a skill that interacts with Gmail, Drive, Calendar, Contacts, Sheets, and Docs, poor handling of OAuth client credentials can enable unauthorized API access or make later account compromise easier.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.