Gog Html Email

PassAudited by ClawScan on May 10, 2026.

Overview

This skill is a straightforward HTML email template helper, but users should remember it sends messages through their gog/Gmail account.

This skill appears benign and purpose-aligned. Before installing or using it, verify that the `gog` CLI is installed from a trusted source, is logged into the correct Gmail account, and that you review each email's recipient and final HTML content before sending.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI02: Tool Misuse and Exploitation

What this means

If used with the wrong recipient, subject, or body, the agent could send an unintended email from the user's configured account.

Why it was flagged

The skill instructs the agent to use a CLI command that sends outbound email. This is expected for the skill, but it is an externally visible action.

Skill content

gog gmail send --to recipient@example.com --subject "Subject" --body-html "$HTML"

Recommendation

Confirm the recipient, subject, and rendered HTML body before allowing the agent to send.

Low

#ASI03: Identity and Privilege Abuse

What this means

Emails may be sent using the Gmail account currently authorized in the local gog CLI.

Why it was flagged

Sending through Gmail implies use of the user's configured gog/Gmail identity, even though no explicit credential is declared in the registry metadata.

Skill content

Send via `gog gmail send --body-html`

Recommendation

Make sure `gog` is authenticated to the intended account and has only the permissions you are comfortable using for this skill.