Gog
v1.0.0Google Workspace CLI for Gmail, Calendar, Drive, Contacts, Sheets, and Docs.
⭐ 830· 151k·3.3k current·3.4k all-time
byPeter Steinberger@steipete
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The SKILL.md describes a Google Workspace CLI (Gmail, Calendar, Drive, Contacts, Sheets, Docs) and its commands — that purpose aligns with the actions shown. However the registry metadata shown to the platform lists no required binaries or install spec, while the SKILL.md includes metadata that requires the 'gog' binary and even provides a Homebrew formula (steipete/tap/gogcli). This mismatch between declared requirements and the runtime instructions is an inconsistency worth verifying.
Instruction Scope
The instructions stay on-topic: they show how to perform OAuth setup with a client_secret.json, add an account and run Gmail/Calendar/Drive/Sheets/Docs commands. They require running a local CLI and providing OAuth credentials (sensitive by nature) but do not instruct the agent to read unrelated system files or exfiltrate data to unexpected endpoints.
Install Mechanism
There is no install spec in the registry listing, yet SKILL.md metadata includes a Homebrew install entry (steipete/tap/gogcli). Installing a third‑party Homebrew tap is moderately risky if you don't trust its source; the registry's omission of the install step is an incoherence that makes it unclear whether the platform will automatically install the binary or expect it preinstalled.
Credentials
No environment variables or primary credentials are declared in the registry, but the SKILL.md requires OAuth credentials (client_secret.json) and suggests setting GOG_ACCOUNT. Requesting OAuth client secrets and access to Google services is proportionate to a workspace CLI, but these are sensitive and the lack of declared credentials in the registry metadata is an omission to confirm.
Persistence & Privilege
The skill does not request always:true and does not declare persistent system-wide changes. It is user-invocable and allows autonomous invocation by default (platform default) — notable but not a standalone red flag in this case.
What to consider before installing
This skill appears to be a wrapper for the 'gog' CLI and legitimately needs OAuth credentials and a local binary. Before installing or using it: 1) Verify the upstream project/homepage (https://gogcli.sh) and the Homebrew tap (steipete/tap/gogcli) are trustworthy — inspect the repository and releases; 2) Prefer installing the 'gog' binary yourself and testing it independently rather than letting an automated installer run; 3) Only provide OAuth client_secret.json and authorize scopes from an account you control (prefer a dedicated/test Google account with least privilege); 4) Be aware the SKILL.md and registry metadata disagree about install/requirements — ask the publisher to clarify why the registry shows no install/binaries while SKILL.md references them; 5) If you are uncomfortable, do not grant access to your primary Google account and consider running the CLI locally instead.Like a lobster shell, security has layers — review code before you run it.
latestvk97dg6nasj52d3s3mcegcwqmx17ykzqb
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🎮 Clawdis
Binsgog
Install
Install gog (brew)
Bins: gog
brew install steipete/tap/gogcli