gog
Pass
Audited by Gen Agent Trust Hub on Mar 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill operates by executing the
gogbinary on the local system to interact with various Google Workspace APIs. - [EXTERNAL_DOWNLOADS]: The skill requires the installation of a third-party binary via the
steipete/tap/gogcliHomebrew tap. - [PROMPT_INJECTION]: The skill processes data from external sources such as Gmail messages, Google Docs, and Google Sheets, which creates an indirect prompt injection surface.
- Ingestion points:
gog gmail search,gog sheets get, andgog docs catcommands in SKILL.md fetch external data. - Boundary markers: No markers or explicit instructions to ignore embedded commands are present in the skill's instructions.
- Capability inventory: The skill has the ability to send emails (
gog gmail send) and update spreadsheet data (gog sheets update) as seen in SKILL.md. - Sanitization: No content validation or sanitization of the fetched data is mentioned or implemented before it reaches the agent.
Audit Metadata