GDrive Owncloud sync

Check that new files on Google Drive are present on OwnCloud + send email report

This skill appears to implement its stated purpose, but exercise caution before installing or running it. Key points to consider: - The skill archive includes a populated owncloud.json and a systemd unit with a plaintext password. Treat these as templates only — do NOT deploy the bundled credentials unchanged. Replace passwords and TLS certs with values you control. - The skill requires gog (installed from steipete/tap/gogcli). Verify that tap and formula are trustworthy before adding the tap and installing the package. - The bundle contains a Go service and a cron/find script that are intended to run on your OwnCloud server and will produce /tmp/allfiles.txt. Review and audit the find command, the service configuration, and file permissions; run the service only on a trusted host and ensure TLS certs are valid. - Confirm how gog authenticates to Google Drive (it may require OAuth tokens or interactive login); avoid placing long-lived credentials in plaintext. The skill's GOG_ACCOUNT in owncloud.json is an account identifier, not an OAuth token. - Before running, remove or sanitize any embedded secrets in the distributed files (owncloud.json, allfiles.service). If you need a second opinion, ask the author whether the included credentials are placeholders and request guidance on secure deployment. If the author can (a) confirm that the embedded password is a placeholder and (b) provide a clear secure deployment guide (how gog auth is handled, explicit note that owncloud.json is local-only template, and provenance for the brew tap), my confidence in the package would increase.

Type: OpenClaw Skill Name: owncloudsync Version: 1.0.0 The skill facilitates a file synchronization check between Google Drive and OwnCloud, generating an email report of missing or outdated files. The bundle includes a Zsh client script and a Go-based backend service to be installed on the OwnCloud server. Analysis reveals significant security-conscious coding practices, such as explicit guards against symlink attacks in findallfiles.sh and allfiles-service.go, regex-based input validation to prevent command injection, and the use of constant-time comparisons for authentication. The behavior is transparent and aligns perfectly with the stated purpose.