thayyilshihab

Google Workspace CLI for Gmail, Calendar, Drive, Contacts, Sheets, and Docs.

Security Scan

The skill is internally consistent with its stated purpose: it wraps the gog Google Workspace CLI (installed from a Homebrew tap) and its instructions reasonably require OAuth credentials and the gog binary.

Purpose & Capability

Name/description match the runtime instructions and the declared required binary (gog). The SKILL.md shows only standard Gmail/Calendar/Drive/Sheets/Docs operations that the gog CLI would provide.

Instruction Scope

Runtime instructions stay within the tool's scope: they tell the agent how to perform OAuth setup (client_secret.json), authenticate accounts, and run gog commands. There are no instructions to read unrelated system files, harvest other credentials, or post data to unexpected endpoints.

Install Mechanism

Install is via a third‑party Homebrew tap (steipete/tap/gogcli) which creates the gog binary — this is a common and reasonable install method but is higher risk than a mainline homebrew/core formula. Recommend reviewing the tap/formula before installing.

Credentials

The skill declares no required env vars, which is consistent with being a CLI wrapper. However, SKILL.md requires an OAuth client_secret.json file and mentions an optional GOG_ACCOUNT env var; those credential/file requirements are reasonable for a Google Workspace CLI but are not reflected in 'required env vars'. Users should be aware that OAuth client secrets and access tokens will be used/stored by the gog tool.

Persistence & Privilege

The skill does not request always:true, does not modify other skills' config, and uses the normal agent invocation model. No elevated persistence or cross-skill access is requested.

Assessment

This skill appears to be a thin wrapper around the gog CLI. Before installing: 1) review the Homebrew tap formula (steipete/tap/gogcli) to confirm its source and contents; 2) be prepared to supply Google OAuth client credentials (client_secret.json) and to grant the gog tool access to Gmail/Drive/Calendar/etc — only grant the minimum scopes needed; 3) check where gog stores OAuth tokens on disk and ensure you’re comfortable with that storage location; 4) avoid using broad account credentials; and 5) test commands with read-only queries before using actions that send mail or create events. If you need higher assurance, verify the gog project homepage/repo and the brew formula source prior to installation.

gog

Use gog for Gmail/Calendar/Drive/Contacts/Sheets/Docs. Requires OAuth setup.

Setup (once)

• gog auth credentials /path/to/client_secret.json
• gog auth add [e-mail] --services gmail,calendar,drive,contacts,sheets,docs
• gog auth list

Common commands

• Gmail search: gog gmail search 'newer_than:7d' --max 10
• Gmail send: gog gmail send --to [e-mail] --subject "Hi" --body "Hello"
• Calendar: gog calendar events <calendarId> --from <iso> --to <iso>
• Drive search: gog drive search "query" --max 10
• Contacts: gog contacts list --max 20
• Sheets get: gog sheets get <sheetId> "Tab!A1:D10" --json
• Sheets update: gog sheets update <sheetId> "Tab!A1:B2" --values-json '[["A","B"],["1","2"]]' --input USER_ENTERED
• Sheets append: gog sheets append <sheetId> "Tab!A:C" --values-json '[["x","y","z"]]' --insert INSERT_ROWS
• Sheets clear: gog sheets clear <sheetId> "Tab!A2:Z"
• Sheets metadata: gog sheets metadata <sheetId> --json
• Docs export: gog docs export <docId> --format txt --out /tmp/doc.txt
• Docs cat: gog docs cat <docId>

Notes

• Set GOG_ACCOUNT=[e-mail] to avoid repeating --account.
• For scripting, prefer --json plus --no-input.
• Sheets values can be passed via --values-json (recommended) or as inline rows.
• Docs supports export/cat/copy. In-place edits require a Docs API client (not in gog).
• Confirm before sending mail or creating events.