Sog

Standards Ops Gadget — CLI for IMAP/SMTP/CalDAV/CardDAV/WebDAV. Open-standards alternative to gog (Google) and mog (Microsoft).

This skill appears to be what it claims: a Go-based CLI for mail, calendars, contacts, tasks, and WebDAV. Before installing, consider these practical safety steps: - Prefer installing a specific, signed/tagged release instead of @latest (e.g., go install github.com/visionik/sogcli/cmd/[email protected]) to reduce supply-chain risk. - Inspect the repository (README, recent commits, open issues, maintainer activity) if you don't already trust the source. - Use the default keychain storage rather than the 'file' storage option so passwords are kept in the system keyring, not in plaintext files. - Be aware the binary will create/modify ~/.config/sog/config.json and will make network connections to whatever servers you configure (this is required functionality). Remove credentials/config if you uninstall. - The SKILL.md contained a unicode-control-chars scanner hit — this may be harmless (emoji/formatting), but if you plan to allow autonomous agent invocation, inspect the raw SKILL.md for hidden characters. If you want extra caution: build the binary from a checked-out tagged commit locally (go build) and audit the code paths that handle password storage and network endpoints before using it with sensitive accounts.

Type: OpenClaw Skill Name: sogcli Version: 0.3.0 The skill bundle is classified as suspicious due to the `sog idle --exec` command in `internal/cli/idle.go`. This command allows the execution of arbitrary shell commands upon receiving new mail, which is a powerful and potentially risky capability. While explicitly documented in `SKILL.md` and `README.md` as an intended feature for automation, it could be abused by a malicious prompt to the AI agent to execute harmful payloads. There is no clear evidence of intentional malicious behavior within the provided code or documentation, but the capability itself presents a significant risk.