Gog(免费)

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:33 AM UTC
• Version: 1.0.1

Overview

This skill is a disclosed Google Workspace CLI helper for Gmail search and Google Sheets read/append actions, with sensitive OAuth access that users should authorize carefully.

Install only if you intend to let an agent use gog with your Google account. Use a dedicated or least-privilege Google account where possible, review OAuth scopes before authorizing, avoid committing client_secret.json or tokens, and confirm any Sheets append operation before running it on important spreadsheets.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (7)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

md

配置后需重启会话或开启新终端生效。API Key应妥善保管,避免泄露到版本控制系统.
## 核心能力

- OAuth 凭证管理:导入 `client_secret.json`、添加账户授权、列出已授权账户
- Gmail 搜索:按 Gmail 搜索语法检索邮件(`newer_than:`、`from:`、`has:attachment` 等)
- Sheets 读取:读取指定范围的数据,支持 JSON 输出
- Sheets 追加:向指定范围追加行数据

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

md

配置后需重启会话或开启新终端生效。API Key应妥善保管,避免泄露到版本控制系统.
## 核心能力

- OAuth 凭证管理:导入 `client_secret.json`、添加账户授权、列出已授权账户
- Gmail 搜索:按 Gmail 搜索语法检索邮件(`newer_than:`、`from:`、`has:attachment` 等)
- Sheets 读取:读取指定范围的数据,支持 JSON 输出
- Sheets 追加:向指定范围追加行数据

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 97)May include surrounding context.

md

配置后需重启会话或开启新终端生效。API Key应妥善保管,避免泄露到版本控制系统.
## 核心能力

- OAuth 凭证管理:导入 `client_secret.json`、添加账户授权、列出已授权账户
- Gmail 搜索:按 Gmail 搜索语法检索邮件(`newer_than:`、`from:`、`has:attachment` 等)
- Sheets 读取:读取指定范围的数据,支持 JSON 输出
- Sheets 追加:向指定范围追加行数据

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 188)May include surrounding context.

md

配置后需重启会话或开启新终端生效。API Key应妥善保管,避免泄露到版本控制系统.
## 核心能力

- OAuth 凭证管理:导入 `client_secret.json`、添加账户授权、列出已授权账户
- Gmail 搜索:按 Gmail 搜索语法检索邮件(`newer_than:`、`from:`、`has:attachment` 等)
- Sheets 读取:读取指定范围的数据,支持 JSON 输出
- Sheets 追加:向指定范围追加行数据

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 189)May include surrounding context.

md

配置后需重启会话或开启新终端生效。API Key应妥善保管,避免泄露到版本控制系统.
## 核心能力

- OAuth 凭证管理:导入 `client_secret.json`、添加账户授权、列出已授权账户
- Gmail 搜索:按 Gmail 搜索语法检索邮件(`newer_than:`、`from:`、`has:attachment` 等)
- Sheets 读取:读取指定范围的数据,支持 JSON 输出
- Sheets 追加:向指定范围追加行数据

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill advertises Gmail search and Sheets write capabilities via OAuth but does not prominently warn users that it can access mailbox contents and modify spreadsheet data. This can cause users to authorize sensitive actions without clear informed consent, increasing the risk of unintended data exposure or tampering in an agent context where commands may be invoked indirectly.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The file presents the skill name, summaries, and nearly all instructions in Chinese, which imposes a specific language/locale experience without documenting user choice or regional justification. Under the stated policy, language constraints should either be optional or clearly justified as region-specific.

Content

No source excerpt is available for this finding.