by 安全扫描
OpenClaw
安全
high confidenceThe skill is an instruction-only wrapper that expects the 'gog' Google Workspace CLI binary and its OAuth setup; its requirements and instructions are consistent with the stated purpose.
评估建议
This skill is instruction-only and coherent: it tells the agent to call a local 'gog' CLI that interacts with Google Workspace via OAuth. Before installing or using it: (1) verify the Homebrew tap/formula (steipete/tap/gogcli) and review the upstream project (https://gogcli.sh) or source code for the gog binary you will run; (2) be prepared to provide OAuth client_secret.json and to authorize the tool — doing so gives the binary access to your Gmail, Drive, Calendar, Contacts, Sheets, and Docs; ...详细分析 ▾
✓ 用途与能力
Name/description match the runtime instructions and the single required binary 'gog'. The SKILL.md documents Gmail/Calendar/Drive/Contacts/Sheets/Docs commands and shows the expected OAuth setup (client_secret.json and account add). Requiring the gog binary and OAuth is proportionate to the stated purpose.
✓ 指令范围
SKILL.md only instructs the agent to run the gog CLI and to perform OAuth credential setup; it does not ask the agent to read unrelated system files, environment variables (aside from an optional GOG_ACCOUNT), or post data to unexpected endpoints. Commands operate on Google Workspace APIs as described and include reasonable cautions (e.g., confirm before sending mail).
ℹ 安装机制
Install uses a Homebrew formula (steipete/tap/gogcli) which is a third‑party tap rather than the core brew repo. Using brew is normal for installing CLI tools, but users should verify the tap/formula origin and contents before installing a binary that will access sensitive Google data.
ℹ 凭证需求
The registry metadata lists no required env vars or credentials, but the SKILL.md explicitly requires OAuth client credentials (client_secret.json) and creating an account token via 'gog auth add'. This is expected for a Google Workspace CLI, but users should be aware the CLI will store OAuth tokens locally and will be able to access their Google data once authorized.
✓ 持久化与权限
Skill is not always-enabled, does not request elevated platform privileges, and does not modify other skills or global agent config. Any persistence is from the gog CLI's own OAuth token storage, which is outside the skill bundle and under the user's control.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/24
Initial release of gog-local – Google Workspace CLI for popular services. - Provides CLI commands for Gmail, Calendar, Drive, Contacts, Sheets, and Docs. - Requires OAuth setup and supports multi-account authentication. - Includes common usage examples for each supported Google service. - Offers scripting and automation-friendly flags, like `--json` and `--no-input`. - Supports batch actions and metadata retrieval across services. - Caution: In-place Google Docs editing is not supported; only export, cat, and copy are available.
● 无害
安装命令
点击复制官方npx clawhub@latest install gog-local
镜像加速npx clawhub@latest install gog-local --registry https://cn.longxiaskill.com