Gog Jasmine Yottol

• Analyzed: Apr 12, 2026, 10:46 PM
• Findings: 1
• Version: 1.0.0
• Hash: 8c2999380701fe718bef1052004defe3960a44f2568bafc254efdbdf06da21a1
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle includes a hardcoded Google OAuth client_secret within the 'credentials.json' file, which is a significant security risk and credential leak. While the 'gog' CLI tool (installed via a third-party brew tap) is a legitimate utility for managing Google Workspace, the inclusion of static credentials and the broad access it grants to sensitive data (Gmail, Drive, Contacts) via an AI agent warrants caution. There is no explicit evidence of malicious intent, but the credential exposure is a critical vulnerability.