saltshaer
v1.0.1Google Workspace CLI for Gmail, Calendar, Drive, Contacts, Sheets, and Docs.
⭐ 0· 193·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The skill's name/description match the instructions: it is a thin, instruction-only skill that expects the 'gog' binary and OAuth setup. One small mismatch: the SKILL.md instructs you to provide a client_secret.json path for OAuth, but the skill metadata declares no required config paths — you will still need that local credentials file to use the CLI.
Instruction Scope
SKILL.md only tells the agent how to run 'gog' commands (auth setup, Gmail/Calendar/Drive/Sheets/Docs operations). It instructs reading a local OAuth credentials file and using the CLI to access Google Workspace services, which is expected for this purpose. It does not instruct broad file-system scans or contacting unexpected external endpoints beyond the Google APIs and the optional brew install source.
Install Mechanism
Install spec uses a Homebrew formula (steipete/tap/gogcli) which is a reasonable, low-risk install method. Note that the formula is in a third-party tap (steipete/tap) — verify the tap's origin and trustworthiness before installing.
Credentials
No environment variables or credentials are declared as required. The SKILL.md suggests an optional GOG_ACCOUNT env var and requires an OAuth client_secret.json file and user authorization for Google services — these are proportionate to a Google Workspace CLI and expected.
Persistence & Privilege
The skill does not request always:true or any elevated persistence. Model invocation is allowed (the platform default) but there is no evidence the skill requests system-wide changes or access to other skills' configuration.
Assessment
This appears to be a straightforward wrapper for the 'gog' Google Workspace CLI, but before installing: 1) Verify the brew tap (steipete/tap) and the formula source (e.g., GitHub repo) to ensure you trust the maintainer. 2) Be prepared to provide a Google OAuth client_secret.json and to grant the CLI access to Gmail/Drive/Calendar/etc — review requested scopes carefully. 3) Store the client_secret.json and any tokens securely; the SKILL.md expects you to read that file locally. 4) Remember the CLI can send email and modify calendar/drive data — confirm actions or restrict permissions if needed. 5) If you want extra assurance, install the 'gog' binary yourself, run it manually to inspect behavior, and only then enable the skill for autonomous use.Like a lobster shell, security has layers — review code before you run it.
latestvk975bc0b1fxzpxhjbkdg1hxng182rm4p
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🎮 Clawdis
Binsgog
Install
Install gog (brew)
Bins: gog
brew install steipete/tap/gogcli