Tmp

Google Workspace CLI for Gmail, Calendar, Drive, Contacts, Sheets, and Docs.

This package largely looks like the open-source gogcli CLI (Homebrew formula + source files) — installing that CLI via the referenced Homebrew tap is consistent with the skill's top-level purpose. However, the bundled gmail documentation also describes using a Maton-managed gateway and asks you to set MATON_API_KEY and call maton.ai endpoints. That is not declared in the skill's top-level requirements and would route Google API calls (and effectively your access tokens) through a third party. Before installing or providing any API key: - Decide whether you want a local OAuth flow (gog auth credentials + gog auth add) or to use a managed gateway. If you want local-only, ignore MATON_API_KEY and follow the gog auth instructions. - Do NOT set MATON_API_KEY or paste secrets unless you trust maton.ai. Verify the Maton service, its privacy/security policies, and whether you intended to delegate API traffic to that provider. - Confirm the Homebrew tap origin: brew tap steipete/tap is cited; verify the tap points to the expected GitHub repo (steipete/gogcli) and the formula's URL/sha256 before installing. - The package metadata/slug (Tmp) and included _meta.json differ from the registry metadata; this mismatch is a red flag — confirm the publisher identity and that you pulled the package from a trusted source. - If you need stricter isolation, install and run the CLI in a disposable environment (VM/container) and inspect network traffic, or build from source after reviewing the repository on GitHub. If you want, I can: list the specific lines in gmail/SKILL.md that reference MATON_API_KEY and maton.ai, or help craft a safe installation checklist (brew tap verification and building from source).

Type: OpenClaw Skill Name: tmp Version: 1.0.1 The OpenClaw AgentSkills bundle for 'gog' is classified as suspicious due to its broad capabilities interacting with sensitive Google Workspace APIs (Gmail, Drive, Calendar, Contacts, Sheets, Docs, Classroom, Chat, Keep) and the inclusion of an email open tracking feature. While the tool demonstrates several positive security practices, such as input sanitization, path traversal checks (e.g., in `docs_import.go`), explicit confirmation for destructive actions (`confirm.go`), and safeguards against running tests on non-test accounts (`common.sh`), the email open tracking functionality (`gmail_send.go`, `tracking/tracking.go`) introduces a notable risk. This feature relies on a configurable `WorkerURL` for tracking pixels, which, if compromised or maliciously configured outside the tool's direct control, could be exploited for data exfiltration. There is no clear evidence of intentional malicious behavior within the provided code, but the combination of extensive API access, sensitive credential handling, and the external dependency of the tracking feature warrants a 'suspicious' classification.