Gog Xiaoshu

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:02 AM UTC
• Version: 1.0.0

Overview

This skill is a coherent Google Workspace CLI wrapper, but it asks users to install an unpinned third-party CLI and authorize broad Google account access that can read and modify sensitive data.

Review the `gogcli` source and Homebrew formula before installing, authorize only the Google services you need, avoid blanket Workspace access for routine tasks, and revoke the OAuth grant when you no longer need the tool. Confirm any command that sends email, creates events, or changes Sheets data before running it.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:5

Finding

Unpinned Third-Party Homebrew Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 5
Vulnerability Type: Unpinned third-party package installation
Risk Level: Medium

Vulnerable Code:

yaml

metadata: {"clawdbot":{"emoji":"🎮","requires":{"bins":["gog"]},"install":[{"id":"brew","kind":"brew","formula":"steipete/tap/gogcli","bins":["gog"],"label":"Install gog (brew)"}]}}

Technical Analysis

The skill directs users to install the gog executable from the third-party Homebrew tap steipete/tap/gogcli, but it does not pin the dependency to a reviewed version, commit, immutable artifact, or cryptographic checksum. Consequently, the executable installed in the future may differ from the implementation evaluated when this skill was published.

This creates a supply-chain trust boundary outside the reviewed project. A compromise of the tap, its upstream release infrastructure, or the formula maintainers' credentials could cause Homebrew to download and execute a modified package. The audited repository contains no local implementation of gog or integrity information with which to verify the installed executable.

No evidence was found that the current dependency is malicious. The vulnerability is the mutable, unverified dependency installation mechanism.

Attack Path

1. An attacker compromises the third-party Homebrew tap, an upstream release source, or credentials authorized to update the formula.
2. The attacker modifies the formula or referenced artifact so that it installs a malicious gog executable.
3. A user follows the skill's installation metadata and installs or upgrades steipete/tap/gogcli.
4. Homebrew retrieves the attacker-controlled version because the skill does not enforce a reviewed version or digest.
5. The malicious executable runs with the invoking user's local privileges.
6. When the user performs the documented OAuth setup or Workspace operations, the executable may access OAuth material and data made ...[truncated 745 chars]

Remediation

View remediation

Remediation Suggestions

• Pin installation to a specific, reviewed gogcli release or immutable commit rather than relying on the mutable latest formula.
• Verify downloaded artifacts with a published SHA-256 checksum and, where available, a maintainer signature or provenance attestation.
• Prefer an official, independently verifiable distribution source with release signing and reproducible provenance.
• Record the expected version and integrity digest in the skill metadata so future installations resolve to the same audited artifact.
• Add an explicit upgrade process requiring review and checksum updates before adopting a new release.
• Apply least privilege during OAuth authorization by enabling only the Google services and scopes required for the user's task.
• Protect OAuth token storage with restrictive filesystem permissions and document how users can revoke credentials after suspected compromise.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md

Use `gog` for Gmail/Calendar/Drive/Contacts/Sheets/Docs. Requires OAuth setup.

Setup (once)
- `gog auth credentials /path/to/client_secret.json`
- `gog auth add [e-mail] --services gmail,calendar,drive,contacts,sheets,docs`
- `gog auth list`