Gog Litiao

Google Workspace CLI for Gmail, Calendar, Drive, Contacts, Sheets, and Docs.

Security Scan

The skill is internally consistent with being a CLI front-end for Google Workspace (it requires the 'gog' binary and documents OAuth setup), but there are a few small omissions and third‑party install details you should verify before installing.

Purpose & Capability

Name/description match the runtime instructions: the skill delegates all work to a gog CLI and its documented commands target Gmail, Calendar, Drive, Contacts, Sheets, and Docs. Requiring a 'gog' binary (and providing a brew install) is proportionate to the stated purpose.

Instruction Scope

SKILL.md contains only CLI usage and OAuth setup steps (gog auth credentials, gog auth add). It does reference an environment variable (GOG_ACCOUNT) for convenience and instructs you to provide a client_secret.json file for OAuth, but it does not declare where auth tokens are stored or whether the CLI will write files to disk. The instructions do not ask the agent to read unrelated system files or contact unexpected endpoints.

Install Mechanism

Install uses a Homebrew tap (steipete/tap/gogcli) which will create a 'gog' binary. Homebrew taps are common, but third‑party taps are less vetted than official core formulae — verify the tap source (review the formula and upstream project) before installing.

Credentials

The registry metadata lists no required env vars or credentials, but the SKILL.md explicitly requires OAuth client credentials (client_secret.json) and suggests setting GOG_ACCOUNT. Requesting OAuth credentials and granting access to Gmail/Drive/Sheets/etc is consistent with the skill's purpose but represents broad access to sensitive data — this is expected for a Google Workspace CLI but is a real security/privacy consideration. The skill does not declare where it stores tokens or whether it will create local config files.

Persistence & Privilege

always is false and model invocation is normal (agent may invoke the skill). The skill does not request persistent platform privileges or modifications to other skills' configurations in the provided instructions.

Scan Findings in Context

[NO_SCAN_FINDINGS] expected: This is an instruction-only skill (no code files) so the regex scanner had nothing to analyze; the SKILL.md is the primary surface to review.

Assessment

This skill delegates actions to an external gog CLI and requires OAuth credentials that can give wide access to your Google Workspace data. Before installing: (1) verify the Homebrew tap (steipete/tap) and review the formula/upstream project for authenticity; (2) only use OAuth client credentials you trust and understand where the CLI stores access/refresh tokens (check local config paths after first auth); (3) grant the minimum service scopes needed (don’t enable all services if you don’t need them); (4) consider testing with a low‑privilege or expendable account first. The SKILL.md mentions GOG_ACCOUNT but the registry metadata doesn’t list it — be aware of this small mismatch and confirm environment usage during setup.

gog

Use gog for Gmail/Calendar/Drive/Contacts/Sheets/Docs. Requires OAuth setup.

Setup (once)

• gog auth credentials /path/to/client_secret.json
• gog auth add [e-mail] --services gmail,calendar,drive,contacts,sheets,docs
• gog auth list

Common commands

• Gmail search: gog gmail search 'newer_than:7d' --max 10
• Gmail send: gog gmail send --to [e-mail] --subject "Hi" --body "Hello"
• Calendar: gog calendar events <calendarId> --from <iso> --to <iso>
• Drive search: gog drive search "query" --max 10
• Contacts: gog contacts list --max 20
• Sheets get: gog sheets get <sheetId> "Tab!A1:D10" --json
• Sheets update: gog sheets update <sheetId> "Tab!A1:B2" --values-json '[["A","B"],["1","2"]]' --input USER_ENTERED
• Sheets append: gog sheets append <sheetId> "Tab!A:C" --values-json '[["x","y","z"]]' --insert INSERT_ROWS
• Sheets clear: gog sheets clear <sheetId> "Tab!A2:Z"
• Sheets metadata: gog sheets metadata <sheetId> --json
• Docs export: gog docs export <docId> --format txt --out /tmp/doc.txt
• Docs cat: gog docs cat <docId>

Notes

• Set GOG_ACCOUNT=[e-mail] to avoid repeating --account.
• For scripting, prefer --json plus --no-input.
• Sheets values can be passed via --values-json (recommended) or as inline rows.
• Docs supports export/cat/copy. In-place edits require a Docs API client (not in gog).
• Confirm before sending mail or creating events.