安全扫描
OpenClaw
安全
high confidenceThe skill is internally consistent: it is an instruction-only wrapper that expects a 'gog' Google Workspace CLI binary (installable via a Homebrew tap) and its runtime instructions match that purpose.
评估建议
This skill appears to do what it says: it expects a standalone 'gog' CLI and instructs you how to use it. Before installing, verify the Homebrew tap (steipete/tap/gogcli) and inspect the formula or the project's GitHub to confirm the binary's source. Protect your OAuth client_secret.json (store it securely), grant only needed Google API scopes, and be aware that the installed 'gog' binary will have normal filesystem and network access (it can read files you point it at and call Google APIs). If ...详细分析 ▾
✓ 用途与能力
The name/description (Google Workspace CLI) match the declared requirements: the skill requires the 'gog' binary and offers commands for Gmail, Calendar, Drive, Contacts, Sheets, and Docs. Requesting a gog binary and offering a Homebrew install is appropriate for this purpose.
✓ 指令范围
SKILL.md only instructs the agent to run the gog CLI and perform OAuth setup (pointing to a local client_secret.json) and typical goog workspace operations. It does not ask the agent to read unrelated files, system secrets, or exfiltrate data to other endpoints. It does reference writing an exported doc to /tmp and suggests using GOG_ACCOUNT to avoid repeating --account, both expected and limited in scope.
ℹ 安装机制
Installation is via Homebrew formula steipete/tap/gogcli which will create the 'gog' binary. Homebrew is a normal install path, but this is a third‑party tap (not the default Homebrew/core). Verify the tap's GitHub/repository and formula contents before installing to ensure the binary's provenance and review build/install steps.
✓ 凭证需求
The skill declares no required environment variables. The runtime notes mention GOG_ACCOUNT (optional) and local OAuth client_secret.json files — these are proportional to a Google API CLI. Users should still protect OAuth client secrets and grant the minimum OAuth scopes needed.
✓ 持久化与权限
The skill is not forced-always and does not request persistent system-wide configuration or other skills' credentials. Autonomous model invocation is allowed (platform default) but not excessive in this skill's metadata.
安全有层次,运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/8
Initial release of gog: a CLI for Google Workspace. - Manage Gmail, Calendar, Drive, Contacts, Sheets, and Docs from the command line. - OAuth setup required for account authorization. - Provides commands for searching, sending, and listing emails; managing calendar events; searching Drive; listing contacts; reading and updating Sheets; and exporting Docs. - Supports scripting via JSON output and options to disable interaction. - Includes tips on environment setup and command usage for efficient workflows.
● 无害
安装命令 点击复制
官方npx clawhub@latest install gog-1
镜像加速npx clawhub@latest install gog-1 --registry https://cn.clawhub-mirror.com
技能文档
Use gog for Gmail/Calendar/Drive/Contacts/Sheets/Docs. Requires OAuth setup.
Setup (once)
gog auth credentials /path/to/client_secret.jsongog auth add you@gmail.com --services gmail,calendar,drive,contacts,sheets,docsgog auth list
Common commands
- Gmail search:
gog gmail search 'newer_than:7d' --max 10 - Gmail send:
gog gmail send --to a@b.com --subject "Hi" --body "Hello" - Calendar:
gog calendar events--from --to - Drive search:
gog drive search "query" --max 10 - Contacts:
gog contacts list --max 20 - Sheets get:
gog sheets get"Tab!A1:D10" --json - Sheets update:
gog sheets update"Tab!A1:B2" --values-json '[["A","B"],["1","2"]]' --input USER_ENTERED - Sheets append:
gog sheets append"Tab!A:C" --values-json '[["x","y","z"]]' --insert INSERT_ROWS - Sheets clear:
gog sheets clear"Tab!A2:Z" - Sheets metadata:
gog sheets metadata--json - Docs export:
gog docs export--format txt --out /tmp/doc.txt - Docs cat:
gog docs cat
Notes
- Set
GOG_ACCOUNT=you@gmail.comto avoid repeating--account. - For scripting, prefer
--jsonplus--no-input. - Sheets values can be passed via
--values-json(recommended) or as inline rows. - Docs supports export/cat/copy. In-place edits require a Docs API client (not in gog).
- Confirm before sending mail or creating events.
数据来源:ClawHub ↗ · 中文优化:龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险,如需更匹配、更安全的方案,建议联系付费定制