Gog.Local.Backup

Google Workspace CLI for Gmail, Calendar, Drive, Contacts, Sheets, and Docs.

Security Scan

This is a coherent Google Workspace CLI wrapper (requires the 'gog' binary) but there are metadata and declaration mismatches and a third‑party Homebrew tap install that warrant caution before installing.

Purpose & Capability

The skill name/description (Google Workspace CLI) matches the runtime instructions and required binary ('gog') and the brew formula provided. However, the registry metadata does not declare the OAuth client credentials that the SKILL.md explicitly requires (client_secret.json / account setup).

Instruction Scope

SKILL.md stays on task: it documents installing and using the gog CLI and how to perform Gmail/Calendar/Drive/Sheets/Docs operations. It instructs the user to provide OAuth client secrets and to run gog auth commands; it does not instruct reading arbitrary unrelated system files or exfiltrating data to external endpoints other than using the gog tool itself.

Install Mechanism

Install is a Homebrew formula (steipete/tap/gogcli) which is a reasonable install mechanism for a CLI, but it's a third‑party tap rather than an official well-known formula. Installing from an untrusted tap carries moderate risk because it installs binaries from that tap.

Credentials

The SKILL.md requires OAuth credentials (client_secret.json) and suggests a GOG_ACCOUNT env var, but the skill metadata lists no required env vars or primary credential. This mismatch means credentials are necessary at runtime but not declared as required in the registry metadata — a transparency/consistency issue that could confuse users and automated reviewers.

Persistence & Privilege

The skill does not request permanent/always presence, does not modify other skills or system-wide settings, and does not declare unusual config path access. Autonomous invocation is allowed (platform default) but not combined here with other high‑risk flags.

What to consider before installing

This skill appears to be what it claims (a Google Workspace CLI helper), but take these precautions: 1) Verify the publisher and the Homebrew tap (steipete/tap) before installing the formula — prefer official releases or inspect the tap's code. 2) The SKILL.md requires OAuth client credentials (client_secret.json) and account setup even though the registry metadata doesn't declare credentials — only provide OAuth files you trust and store them securely. 3) Review the gog binary (or its source) before running it, and check what OAuth scopes it requests (Gmail/Drive/etc.). 4) Don't supply unrelated secrets or system credentials. If you want higher assurance, ask the publisher for source code or a canonical release (GitHub/GitHub Releases) and confirm the homepage and owner identity (note: ownerId in _meta.json differs from registry metadata).

gog

Use gog for Gmail/Calendar/Drive/Contacts/Sheets/Docs. Requires OAuth setup.

Setup (once)

• gog auth credentials /path/to/client_secret.json
• gog auth add [e-mail] --services gmail,calendar,drive,contacts,sheets,docs
• gog auth list

Common commands

• Gmail search: gog gmail search 'newer_than:7d' --max 10
• Gmail send: gog gmail send --to [e-mail] --subject "Hi" --body "Hello"
• Calendar: gog calendar events <calendarId> --from <iso> --to <iso>
• Drive search: gog drive search "query" --max 10
• Contacts: gog contacts list --max 20
• Sheets get: gog sheets get <sheetId> "Tab!A1:D10" --json
• Sheets update: gog sheets update <sheetId> "Tab!A1:B2" --values-json '[["A","B"],["1","2"]]' --input USER_ENTERED
• Sheets append: gog sheets append <sheetId> "Tab!A:C" --values-json '[["x","y","z"]]' --insert INSERT_ROWS
• Sheets clear: gog sheets clear <sheetId> "Tab!A2:Z"
• Sheets metadata: gog sheets metadata <sheetId> --json
• Docs export: gog docs export <docId> --format txt --out /tmp/doc.txt
• Docs cat: gog docs cat <docId>

Notes

• Set GOG_ACCOUNT=[e-mail] to avoid repeating --account.
• For scripting, prefer --json plus --no-input.
• Sheets values can be passed via --values-json (recommended) or as inline rows.
• Docs supports export/cat/copy. In-place edits require a Docs API client (not in gog).
• Confirm before sending mail or creating events.