Google Docs from Markdown

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI03: Identity and Privilege Abuse

What this means

When invoked, the skill can create/upload documents in the Google Drive account currently authenticated in gog.

Why it was flagged

The skill depends on an already authenticated Google account through gog, so its Drive upload action will operate with that account’s permissions.

Skill content

- `gog` CLI authenticated with Google account

Recommendation

Confirm gog is logged into the intended Google account and only run the skill for Markdown files you want uploaded to Drive.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

First use may run a downloaded Pandoc binary from /tmp, which depends on trusting the GitHub release download path and network integrity.

Why it was flagged

If Pandoc is missing, the helper downloads and extracts a third-party binary from GitHub at runtime without a checksum verification step.

Skill content

wget -q https://github.com/jgm/pandoc/releases/download/3.1.11/pandoc-3.1.11-linux-amd64.tar.gz
    tar xzf pandoc-3.1.11-linux-amd64.tar.gz

Recommendation

Prefer installing Pandoc through a trusted package manager or verify the release checksum before relying on the auto-download path.