ClawHub
Back to skill

Security audit

Gog Free

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent Google Workspace command guide, but users should handle OAuth credentials, Gmail exports, and Sheet append operations carefully.

Install only if you intend to let an agent run gog commands against your Google account. Confirm target spreadsheet IDs and ranges before any append, keep Gmail searches narrow, avoid exporting sensitive mail on shared systems, and store OAuth client secrets and tokens securely.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill explicitly documents a command that appends rows to Google Sheets, which modifies remote user data, but it does not prominently warn that the action is state-changing and may alter production spreadsheets. In an agent context, users may treat examples as safe to run, so omission of a mutation warning increases the risk of unintended data modification.

Missing User Warnings

Medium
Confidence
86% confidence
Finding
The example shows exporting Gmail search results, including metadata and attachment names, to a local JSON file without a clear privacy warning. Email search results can contain sensitive personal or corporate information, and normalizing them into local files increases the chance of accidental disclosure, retention, or ingestion by other tools.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The documentation references API keys and OAuth credentials but does not provide a consolidated warning about the sensitivity of these secrets or the account access they enable. In agent-assisted environments, users may paste or store credentials insecurely, leading to compromise of Gmail and Sheets access.

VirusTotal

57/57 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.