Google Calendar CLI

ReviewAudited by ClawScan on May 16, 2026.

Overview

This is a straightforward instruction-only Google Calendar CLI helper, but it requires Google Calendar OAuth access and can modify calendar events.

Install this only if you trust the gog CLI and its Homebrew tap. Connect a Google account intentionally, grant the minimum needed Calendar access, and review any create, update, delete, bulk, or --no-input commands before allowing the agent to run them.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Medium

#ASI03: Identity and Privilege Abuse

What this means

The CLI may be able to read and change calendar information for the connected Google account.

Why it was flagged

The skill requires setting up OAuth credentials and granting Google Calendar access to the gog CLI. This is expected for calendar management, but it gives the CLI access to account calendar data.

Skill content

gog auth credentials /path/to/client_secret.json

gog auth add you@gmail.com --services calendar

Recommendation

Use a Google account and OAuth client you trust, grant only the needed calendar scope, and periodically review or revoke the gog authorization if no longer needed.

Medium

#ASI02: Tool Misuse and Exploitation

What this means

Incorrect or unintended commands could add, change, or automate changes to calendar events.

Why it was flagged

The documented CLI commands can create or update calendar events, and the skill mentions non-interactive automation. These actions are purpose-aligned, but they can mutate the user's calendar if run without review.

Skill content

gog calendar create primary --summary "Team Meeting" ...
gog calendar update primary <eventId> --summary "Updated Meeting Title" ...
Batch with --no-input: Use `--no-input` for automated scripts

Recommendation

Review commands before execution, especially scripts, bulk operations, and any use of --no-input.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Security depends partly on the external gog CLI package and its Homebrew tap.

Why it was flagged

The skill depends on installing an external CLI from a Homebrew tap, while the skill itself contains no code or lockfile. This is a normal setup step for an instruction-only CLI helper, but the external package is outside the reviewed artifacts.

Skill content

brew install steipete/tap/gogcli

Recommendation

Verify the gog CLI source and Homebrew tap before installing, and keep it updated from a trusted source.