Gog Bwm

Google Workspace CLI for Gmail, Calendar, Drive, Contacts, Sheets, and Docs.

Security Scan

The skill is internally consistent: it is an instruction-only wrapper around a 'gog' Google Workspace CLI, requires the gog binary (installable via a Homebrew tap), and its runtime instructions are limited to expected OAuth setup and gog commands.

Purpose & Capability

The skill's name/description match its requirements — it needs the 'gog' binary and OAuth credentials to operate on Gmail, Calendar, Drive, Contacts, Sheets, and Docs. There are no unrelated binaries, env vars, or config paths requested.

Instruction Scope

SKILL.md contains concrete gog CLI commands and a required OAuth setup flow (client_secret.json + account add). It references an optional GOG_ACCOUNT env var and an output path (/tmp/doc.txt) — all of which are coherent with a Google Workspace CLI and do not ask the agent to read or exfiltrate unrelated system files.

Install Mechanism

Install is via a Homebrew formula (steipete/tap/gogcli), which is a low-risk, standard package mechanism. As with any third-party tap, verify the tap/maintainer and review the formula source if you don't already trust steipete/tap.

Credentials

The registry metadata declares no required env vars, which is reasonable. The runtime instructions do require OAuth client credentials (client_secret.json) and optionally mention GOG_ACCOUNT; these are expected but sensitive because they grant access to Google Workspace data. No unrelated credentials are requested.

Persistence & Privilege

always is false and the skill does not request persistent/system-wide privileges or modify other skills. The agent may invoke the skill autonomously (default), which is normal; there is no unusual privilege escalation.

Assessment

This skill appears to do what it says, but check a few things before installing: (1) verify the Homebrew tap (steipete/tap) and inspect the formula source on GitHub to ensure you trust the maintainer; (2) be prepared to provide OAuth client credentials (client_secret.json) — those are sensitive and will grant access to the Google services listed, so restrict scopes to the minimum necessary; (3) the SKILL.md references an optional GOG_ACCOUNT env var and file paths like /tmp/doc.txt — ensure exported files and credentials are handled securely; (4) test gog commands manually before allowing any automated/agent-driven actions that send email or modify calendar/drive content; and (5) if you need higher assurance, visit the homepage (https://gogcli.sh) and confirm the project’s source and documentation.

gog

Use gog for Gmail/Calendar/Drive/Contacts/Sheets/Docs. Requires OAuth setup.

Setup (once)

• gog auth credentials /path/to/client_secret.json
• gog auth add [e-mail] --services gmail,calendar,drive,contacts,sheets,docs
• gog auth list

Common commands

• Gmail search: gog gmail search 'newer_than:7d' --max 10
• Gmail send: gog gmail send --to [e-mail] --subject "Hi" --body "Hello"
• Calendar: gog calendar events <calendarId> --from <iso> --to <iso>
• Drive search: gog drive search "query" --max 10
• Contacts: gog contacts list --max 20
• Sheets get: gog sheets get <sheetId> "Tab!A1:D10" --json
• Sheets update: gog sheets update <sheetId> "Tab!A1:B2" --values-json '[["A","B"],["1","2"]]' --input USER_ENTERED
• Sheets append: gog sheets append <sheetId> "Tab!A:C" --values-json '[["x","y","z"]]' --insert INSERT_ROWS
• Sheets clear: gog sheets clear <sheetId> "Tab!A2:Z"
• Sheets metadata: gog sheets metadata <sheetId> --json
• Docs export: gog docs export <docId> --format txt --out /tmp/doc.txt
• Docs cat: gog docs cat <docId>

Notes

• Set GOG_ACCOUNT=[e-mail] to avoid repeating --account.
• For scripting, prefer --json plus --no-input.
• Sheets values can be passed via --values-json (recommended) or as inline rows.
• Docs supports export/cat/copy. In-place edits require a Docs API client (not in gog).
• Confirm before sending mail or creating events.