安全扫描
OpenClaw
可疑
medium confidenceThe skill is a reasonable Google Workspace CLI wrapper and mostly coherent, but it asks you to install a third‑party brew formula and its instructions expect OAuth client credential files that are not declared — verify the brew tap and OAuth handling before installing.
评估建议
This skill appears to be what it says (a Google Workspace CLI helper) but take these precautions before installing:
- Verify the Homebrew tap/formula (steipete/tap/gogcli): inspect the tap/formula source or prefer an official/known release to avoid running unexpected code from a third‑party tap.
- Understand OAuth: the SKILL.md expects a client_secret.json and will request OAuth scopes that can read/send mail and modify Drive/Calendar/Sheets. Only use an account you trust and review which scope...详细分析 ▾
✓ 用途与能力
Name/description match the actual requirements and instructions: the skill requires the 'gog' CLI and the SKILL.md shows commands for Gmail, Calendar, Drive, Contacts, Sheets, and Docs. There are no unrelated binaries or unexplained capabilities requested.
ℹ 指令范围
SKILL.md limits runtime actions to using the 'gog' CLI and Google OAuth flows (gog auth credentials, gog auth add, various gog commands). It does not instruct reading unrelated system files or exfiltrating data. It does, however, expect you to supply an OAuth client_secret.json path and will perform actions that can access/send your Google data (e.g., sending email), so those scopes warrant review.
ℹ 安装机制
Install is via Homebrew formula steipete/tap/gogcli which creates the 'gog' binary. Using a third‑party tap is a moderate risk compared with an official formula or verified GitHub release — you should review the tap/formula source before installing.
⚠ 凭证需求
Registry metadata declares no required env vars, but the SKILL.md expects OAuth client credentials (client_secret.json) and mentions GOG_ACCOUNT. The skill will obtain OAuth tokens and access your Google account(s) (including sending mail). The credential/config handling is not declared explicitly in requires.env or required config paths — this mismatch should be clarified.
✓ 持久化与权限
Skill is not marked always:true and does not request system-wide configuration changes. Installing the brew formula will place a binary on disk (normal for a CLI). The skill does not declare elevated or persistent platform privileges beyond standard CLI install.
安全有层次,运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/2/21
- Initial release of the asdasdas skill. - Provides a CLI for Google Workspace: Gmail, Calendar, Drive, Contacts, Sheets, and Docs. - Includes setup instructions for OAuth and account configuration. - Offers common command examples for each supported Google service. - Emphasizes scripting features and best practices, including use of `--json` and `--no-input`. - Notes special behaviors and requirements, such as mail/event confirmation and Docs editing limitations.
● 无害
安装命令 点击复制
官方npx clawhub@latest install asdasdas
镜像加速npx clawhub@latest install asdasdas --registry https://cn.clawhub-mirror.com
技能文档
Use gog for Gmail/Calendar/Drive/Contacts/Sheets/Docs. Requires OAuth setup.
INSTALLATION AND USE INSTRUCTIONS
Setup (once)
gog auth credentials /path/to/client_secret.jsongog auth add you@gmail.com --services gmail,calendar,drive,contacts,sheets,docsgog auth list
Common commands
- Gmail search:
gog gmail search 'newer_than:7d' --max 10 - Gmail send:
gog gmail send --to a@b.com --subject "Hi" --body "Hello" - Calendar:
gog calendar events--from --to - Drive search:
gog drive search "query" --max 10 - Contacts:
gog contacts list --max 20 - Sheets get:
gog sheets get"Tab!A1:D10" --json - Sheets update:
gog sheets update"Tab!A1:B2" --values-json '[["A","B"],["1","2"]]' --input USER_ENTERED - Sheets append:
gog sheets append"Tab!A:C" --values-json '[["x","y","z"]]' --insert INSERT_ROWS - Sheets clear:
gog sheets clear"Tab!A2:Z" - Sheets metadata:
gog sheets metadata--json - Docs export:
gog docs export--format txt --out /tmp/doc.txt - Docs cat:
gog docs cat
Notes
- Set
GOG_ACCOUNT=you@gmail.comto avoid repeating--account. - For scripting, prefer
--jsonplus--no-input. - Sheets values can be passed via
--values-json(recommended) or as inline rows. - Docs supports export/cat/copy. In-place edits require a Docs API client (not in gog).
- Confirm before sending mail or creating events.
数据来源:ClawHub ↗ · 中文优化:龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险,如需更匹配、更安全的方案,建议联系付费定制