Gog

Google Workspace CLI for Gmail, Calendar, Drive, Contacts, Sheets, and Docs.

Security Scan

The skill's instructions look like a legitimate Google Workspace CLI, but the registry metadata and SKILL.md disagree about required binaries/install, and the skill asks you to supply OAuth credentials and run local commands — verify the source before installing or granting account access.

Purpose & Capability

The SKILL.md describes a Google Workspace CLI (Gmail, Calendar, Drive, Contacts, Sheets, Docs) and its commands — that purpose aligns with the actions shown. However the registry metadata shown to the platform lists no required binaries or install spec, while the SKILL.md includes metadata that requires the 'gog' binary and even provides a Homebrew formula (steipete/tap/gogcli). This mismatch between declared requirements and the runtime instructions is an inconsistency worth verifying.

Instruction Scope

The instructions stay on-topic: they show how to perform OAuth setup with a client_secret.json, add an account and run Gmail/Calendar/Drive/Sheets/Docs commands. They require running a local CLI and providing OAuth credentials (sensitive by nature) but do not instruct the agent to read unrelated system files or exfiltrate data to unexpected endpoints.

Install Mechanism

There is no install spec in the registry listing, yet SKILL.md metadata includes a Homebrew install entry (steipete/tap/gogcli). Installing a third‑party Homebrew tap is moderately risky if you don't trust its source; the registry's omission of the install step is an incoherence that makes it unclear whether the platform will automatically install the binary or expect it preinstalled.

Credentials

No environment variables or primary credentials are declared in the registry, but the SKILL.md requires OAuth credentials (client_secret.json) and suggests setting GOG_ACCOUNT. Requesting OAuth client secrets and access to Google services is proportionate to a workspace CLI, but these are sensitive and the lack of declared credentials in the registry metadata is an omission to confirm.

Persistence & Privilege

The skill does not request always:true and does not declare persistent system-wide changes. It is user-invocable and allows autonomous invocation by default (platform default) — notable but not a standalone red flag in this case.

What to consider before installing

This skill appears to be a wrapper for the 'gog' CLI and legitimately needs OAuth credentials and a local binary. Before installing or using it: 1) Verify the upstream project/homepage (https://gogcli.sh) and the Homebrew tap (steipete/tap/gogcli) are trustworthy — inspect the repository and releases; 2) Prefer installing the 'gog' binary yourself and testing it independently rather than letting an automated installer run; 3) Only provide OAuth client_secret.json and authorize scopes from an account you control (prefer a dedicated/test Google account with least privilege); 4) Be aware the SKILL.md and registry metadata disagree about install/requirements — ask the publisher to clarify why the registry shows no install/binaries while SKILL.md references them; 5) If you are uncomfortable, do not grant access to your primary Google account and consider running the CLI locally instead.

Use gog for Gmail/Calendar/Drive/Contacts/Sheets/Docs. Requires OAuth setup.

Setup (once)

• gog auth credentials /path/to/client_secret.json
• gog auth add [e-mail] --services gmail,calendar,drive,contacts,sheets,docs
• gog auth list

Common commands

• Gmail search: gog gmail search 'newer_than:7d' --max 10
• Gmail send: gog gmail send --to [e-mail] --subject "Hi" --body "Hello"
• Calendar: gog calendar events <calendarId> --from <iso> --to <iso>
• Drive search: gog drive search "query" --max 10
• Contacts: gog contacts list --max 20
• Sheets get: gog sheets get <sheetId> "Tab!A1:D10" --json
• Sheets update: gog sheets update <sheetId> "Tab!A1:B2" --values-json '[["A","B"],["1","2"]]' --input USER_ENTERED
• Sheets append: gog sheets append <sheetId> "Tab!A:C" --values-json '[["x","y","z"]]' --insert INSERT_ROWS
• Sheets clear: gog sheets clear <sheetId> "Tab!A2:Z"
• Sheets metadata: gog sheets metadata <sheetId> --json
• Docs export: gog docs export <docId> --format txt --out /tmp/doc.txt
• Docs cat: gog docs cat <docId>

Notes

• Set GOG_ACCOUNT=[e-mail] to avoid repeating --account.
• For scripting, prefer --json plus --no-input.
• Sheets values can be passed via --values-json (recommended) or as inline rows.
• Docs supports export/cat/copy. In-place edits require a Docs API client (not in gog).
• Confirm before sending mail or creating events.