Gog V2

Google Workspace CLI for Gmail, Calendar, Drive, Contacts, Sheets, and Docs.

Security Scan

The skill is internally consistent: it is an instruction-only wrapper around the gog CLI for Google Workspace and only requires that binary and OAuth credentials, which matches its description.

Purpose & Capability

Name/description advertise a Google Workspace CLI and the skill only requires the 'gog' binary and OAuth credentials; these are appropriate and proportional to the stated purpose.

Instruction Scope

SKILL.md contains only usage instructions for the gog CLI (auth setup, example commands for Gmail/Calendar/Drive/Contacts/Sheets/Docs). It does not instruct reading unrelated files or contacting endpoints other than the Google APIs via the gog tool. It mentions using a client_secret.json and OAuth flows, which is expected for this type of tool.

Install Mechanism

Install uses a Homebrew formula (steipete/tap/gogcli). Brew installs are normal, but this is a third-party tap rather than a core/homebrew package. Users should verify the tap and formula source before installing.

Credentials

The skill declares no required environment variables. SKILL.md notes an optional GOG_ACCOUNT env var and requires an OAuth client_secret.json for setup — both are proportional. Be aware OAuth client secrets and resulting tokens will be used/stored by the gog CLI and grant access to Gmail/Drive/etc.

Persistence & Privilege

always is false and the skill does not request system-wide configuration or modify other skills. Autonomous invocation is allowed by default (platform normal), and nothing here suggests excessive persistence or privilege escalation.

Assessment

This skill is a thin wrapper around the 'gog' CLI and appears coherent with that purpose. Before installing or using it: - Verify the brew tap/formula (steipete/tap/gogcli) is from a trusted source; inspect the formula or upstream project if possible. - Review the gog project's homepage/repo to confirm behavior and where OAuth tokens are stored. - When performing auth, understand that the client_secret.json and the OAuth tokens granted to the tool will allow access to Gmail, Drive, Calendar, Contacts, Sheets, and Docs — limit scopes and accounts used if you want least privilege (consider a dedicated account). - Prefer interactive consent and inspect any files the tool writes (token stores) after initial auth. If you are uncertain about the third-party tap, consider installing from a verified upstream release or building from source.

gog

Use gog for Gmail/Calendar/Drive/Contacts/Sheets/Docs. Requires OAuth setup.

Setup (once)

• gog auth credentials /path/to/client_secret.json
• gog auth add [e-mail] --services gmail,calendar,drive,contacts,sheets,docs
• gog auth list

Common commands

• Gmail search: gog gmail search 'newer_than:7d' --max 10
• Gmail send: gog gmail send --to [e-mail] --subject "Hi" --body "Hello"
• Calendar: gog calendar events <calendarId> --from <iso> --to <iso>
• Drive search: gog drive search "query" --max 10
• Contacts: gog contacts list --max 20
• Sheets get: gog sheets get <sheetId> "Tab!A1:D10" --json
• Sheets update: gog sheets update <sheetId> "Tab!A1:B2" --values-json '[["A","B"],["1","2"]]' --input USER_ENTERED
• Sheets append: gog sheets append <sheetId> "Tab!A:C" --values-json '[["x","y","z"]]' --insert INSERT_ROWS
• Sheets clear: gog sheets clear <sheetId> "Tab!A2:Z"
• Sheets metadata: gog sheets metadata <sheetId> --json
• Docs export: gog docs export <docId> --format txt --out /tmp/doc.txt
• Docs cat: gog docs cat <docId>

Notes

• Set GOG_ACCOUNT=[e-mail] to avoid repeating --account.
• For scripting, prefer --json plus --no-input.
• Sheets values can be passed via --values-json (recommended) or as inline rows.
• Docs supports export/cat/copy. In-place edits require a Docs API client (not in gog).
• Confirm before sending mail or creating events.