.Gog.Disabled.20260401 113230

Google Workspace CLI for Gmail, Calendar, Drive, Contacts, Sheets, and Docs.

Security Scan

The skill's declared purpose (a Google Workspace CLI wrapper) matches its instructions and install method; nothing requested or instructed is disproportionate, though there are a few minor metadata and install-source notes you should be aware of.

Purpose & Capability

Name/description describe a Google Workspace CLI and the skill only requires the 'gog' binary and documents OAuth setup — these are consistent. Minor oddities: the skill name (.Gog.Disabled...) is unusual and the registry Owner ID in the listing differs from the ownerId in _meta.json, which is a metadata inconsistency but does not by itself change functionality.

Instruction Scope

SKILL.md contains only CLI usage and setup instructions for OAuth credentials and account selection; it does not instruct reading unrelated system files, exfiltrating data, or calling unexpected endpoints. It clearly confines actions to gog commands and Google APIs.

Install Mechanism

Install uses a Homebrew formula 'steipete/tap/gogcli' which will install the 'gog' binary — this is a normal install flow but uses a third-party tap rather than an official core formula. Installing from a third‑party tap has more risk than an official source; verify the tap/project (e.g., GitHub repo, release history) before installing.

Credentials

The skill does not declare required env vars but the SKILL.md mentions an optional GOG_ACCOUNT env var and requires an OAuth client_secret.json file and adding an account via 'gog auth' — these are appropriate for a Google CLI. The minor inconsistency is that GOG_ACCOUNT is referenced but not listed in requires.env; otherwise credential requirements (OAuth client secrets/accounts) are proportional to the stated purpose.

Persistence & Privilege

The skill is not always-enabled and does not request system-wide persistence or elevated privileges. It is user-invocable and allows normal autonomous invocation (platform default), which is expected for a CLI integration.

Assessment

This skill appears coherent for a Google Workspace CLI. Before installing: 1) verify the Homebrew tap (steipete/tap) and the project homepage (https://gogcli.sh or the tap's repo) to confirm source integrity; 2) be prepared to create and store OAuth client credentials (client_secret.json) locally — the CLI will use those to access your Google data; 3) note the SKILL.md mentions the optional GOG_ACCOUNT env var (not listed in metadata) — understand where you will set that if you want convenience. If you are uncomfortable installing packages from a third‑party Homebrew tap, consider auditing the tap repo or building the tool from source.

gog

Use gog for Gmail/Calendar/Drive/Contacts/Sheets/Docs. Requires OAuth setup.

Setup (once)

• gog auth credentials /path/to/client_secret.json
• gog auth add [e-mail] --services gmail,calendar,drive,contacts,sheets,docs
• gog auth list

Common commands

• Gmail search: gog gmail search 'newer_than:7d' --max 10
• Gmail send: gog gmail send --to [e-mail] --subject "Hi" --body "Hello"
• Calendar: gog calendar events <calendarId> --from <iso> --to <iso>
• Drive search: gog drive search "query" --max 10
• Contacts: gog contacts list --max 20
• Sheets get: gog sheets get <sheetId> "Tab!A1:D10" --json
• Sheets update: gog sheets update <sheetId> "Tab!A1:B2" --values-json '[["A","B"],["1","2"]]' --input USER_ENTERED
• Sheets append: gog sheets append <sheetId> "Tab!A:C" --values-json '[["x","y","z"]]' --insert INSERT_ROWS
• Sheets clear: gog sheets clear <sheetId> "Tab!A2:Z"
• Sheets metadata: gog sheets metadata <sheetId> --json
• Docs export: gog docs export <docId> --format txt --out /tmp/doc.txt
• Docs cat: gog docs cat <docId>

Notes

• Set GOG_ACCOUNT=[e-mail] to avoid repeating --account.
• For scripting, prefer --json plus --no-input.
• Sheets values can be passed via --values-json (recommended) or as inline rows.
• Docs supports export/cat/copy. In-place edits require a Docs API client (not in gog).
• Confirm before sending mail or creating events.