安全扫描
OpenClaw
安全
high confidenceThe skill is an instruction-only wrapper that expects the gog CLI (installed from a Homebrew tap) and OAuth credentials to operate; its requirements and instructions are coherent with a Google Workspace CLI.
评估建议
This skill appears to be what it says: a wrapper around the 'gog' Google Workspace CLI. Before installing, verify the source: check the Homebrew tap (steipete/tap) formula and the project's repository/homepage (gogcli.sh) to confirm maintainers and review code. Be deliberate about OAuth credentials: follow least-privilege practices (create a dedicated test Google account or limited-scope client), inspect the OAuth consent/scopes requested, and do not reuse high-privilege or personal workspace cr...详细分析 ▾
ℹ 用途与能力
The description (Google Workspace CLI) matches the runtime instructions which call the gog binary. The brew install target (steipete/tap/gogcli) produces the expected 'gog' binary. Minor oddities: the skill and SKILL.md name fields are gibberish/placeholder, and the registry source is 'unknown', but these are not direct functional mismatches.
✓ 指令范围
SKILL.md only instructs how to install and use the gog CLI and how to provide OAuth client_secret.json and add an account for the listed Google services. It does not instruct reading unrelated local files or contacting unexpected endpoints. It does reference an external "READ THE INSTRUCTIONS" link; users should review that link.
ℹ 安装机制
The install method uses a third-party Homebrew tap (steipete/tap/gogcli) to install the 'gog' binary. Brew taps are common but third-party taps carry more trust risk than an official/homebrew-core package — worth inspecting the tap/formula before installing.
ℹ 凭证需求
The skill does not declare required env vars, but usage implies supplying an OAuth client_secret.json and granting access to Gmail/Calendar/Drive/Contacts/Sheets/Docs. This is proportionate to the described functionality, but granting OAuth tokens yields broad access to the user's Google Workspace data and should be done with least privilege and caution.
✓ 持久化与权限
always is false and the skill does not request system-wide or persistent privileges beyond installing/using the 'gog' CLI. Note: autonomous invocation is allowed by default (normal for skills) — if the agent is granted OAuth credentials, it could perform high-impact actions (sending mail, creating events, modifying Drive/Sheets).
安全有层次,运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/2/21
- Initial release of Google Workspace CLI skill covering Gmail, Calendar, Drive, Contacts, Sheets, and Docs. - Provides detailed setup and OAuth authentication instructions. - Includes example commands for searching, sending, and managing data across Google services. - Offers tips for scripting and account configuration. - Notes on limitations and specific command usage.
● 可疑
安装命令 点击复制
官方npx clawhub@latest install fsdfsd
镜像加速npx clawhub@latest install fsdfsd --registry https://cn.clawhub-mirror.com
技能文档
Use gog for Gmail/Calendar/Drive/Contacts/Sheets/Docs. Requires OAuth setup.
READ THE INSTRUCTIONS BEFORE USE
Setup (once)
gog auth credentials /path/to/client_secret.jsongog auth add you@gmail.com --services gmail,calendar,drive,contacts,sheets,docsgog auth list
Common commands
- Gmail search:
gog gmail search 'newer_than:7d' --max 10 - Gmail send:
gog gmail send --to a@b.com --subject "Hi" --body "Hello" - Calendar:
gog calendar events--from --to - Drive search:
gog drive search "query" --max 10 - Contacts:
gog contacts list --max 20 - Sheets get:
gog sheets get"Tab!A1:D10" --json - Sheets update:
gog sheets update"Tab!A1:B2" --values-json '[["A","B"],["1","2"]]' --input USER_ENTERED - Sheets append:
gog sheets append"Tab!A:C" --values-json '[["x","y","z"]]' --insert INSERT_ROWS - Sheets clear:
gog sheets clear"Tab!A2:Z" - Sheets metadata:
gog sheets metadata--json - Docs export:
gog docs export--format txt --out /tmp/doc.txt - Docs cat:
gog docs cat
Notes
- Set
GOG_ACCOUNT=you@gmail.comto avoid repeating--account. - For scripting, prefer
--jsonplus--no-input. - Sheets values can be passed via
--values-json(recommended) or as inline rows. - Docs supports export/cat/copy. In-place edits require a Docs API client (not in gog).
- Confirm before sending mail or creating events.
数据来源:ClawHub ↗ · 中文优化:龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险,如需更匹配、更安全的方案,建议联系付费定制