clawlaunch-gog

Fail

Audited by Socket on Feb 18, 2026

1 alert found:

Obfuscated File
Obfuscated FileHIGH
references/setup-guide.md

This document is a high-risk operational guide enabling credential disclosure and token harvesting. It actively instructs users to paste OAuth client secrets and single-use authorization codes into chat and to bypass Google security warnings. The text itself is not program code or an obfuscated payload, but the workflow it prescribes can readily result in account compromise and long-lived unauthorized access to Google services if the recipient of the pasted data or the 'gog' binary is malicious or compromised. Strong recommendation: never paste OAuth client JSON or authorization redirect URLs into untrusted channels; perform OAuth flows locally and keep client secrets confined to trusted local storage; only approve apps you trust and do not bypass 'unverified app' warnings except for well-understood, local testing with trusted code.

Confidence: 98%
Audit Metadata
Analyzed At
Feb 18, 2026, 01:49 PM
Package URL
pkg:socket/skills-sh/leto-labs%2Fopenclaw-bootstrap-config%2Fclawlaunch-gog%2F@3355ac452ded46869a93b9890540dcaa74259f0a