Is luccast/gogcli safe?
https://github.com/openclaw/skills/tree/main/skills/luccast/gogcli
The gogcli skill package contains only clean documentation (SKILL.md) and metadata (_meta.json) with no executable code, no injection patterns, no git hooks, and no exfiltration payloads. Sensitive credential files were accessed during the audit window but the timing pattern (pre- and post-install only) and intact canary integrity strongly suggest these accesses originated from the audit framework's own canary baseline checks rather than the skill. The primary risk vector is the skill's extremely broad declared scope over all Google Workspace services and its dependency on an unaudited external binary (steipete/gogcli), meaning any compromise of that upstream repository would execute with agent-level permissions.
Category Scores
Findings (6)
MEDIUM Credential files opened during monitored window -20 ▶
Six sensitive credential and key files were opened and read during the audit monitoring window: .env, .ssh/id_rsa, .aws/credentials, .npmrc, .docker/config.json, and .config/gcloud/application_default_credentials.json. Accesses occurred at two distinct timestamps — 11:04:59 (pre-install) and 11:05:16 (post-install complete) — which corresponds to the pattern of the audit harness establishing pre/post canary baselines. All canary files remain intact per integrity check. Responsibility cannot be conclusively assigned to the skill vs the framework without additional process-level attribution.
LOW External repository reference in install instructions -13 ▶
SKILL.md instructs agents to execute 'git clone https://github.com/steipete/gogcli.git' and 'brew install steipete/tap/gogcli'. An LLM agent following these instructions at user direction would fetch and execute code from an external, unaudited source. The content of the SKILL.md itself contains no injection, but the downstream repository is not covered by this audit.
LOW External binary required for functionality -14 ▶
The skill's advertised functionality requires downloading and compiling an external binary (steipete/gogcli) not included in the skill package. This binary was not audited and could contain malicious behavior, supply chain compromises, or excessive permissions.
LOW Extremely broad Google Workspace data access scope -40 ▶
If installed and active, this skill grants an LLM agent the documented ability to search and send Gmail, list and upload Drive files, read and modify Calendar events, search Contacts, manage Tasks, and access Google Sheets and Docs. In an agentic loop, a malicious prompt or confused-deputy attack could trigger mass data exfiltration or unauthorized communication under the user's Google identity.
INFO Clean install — only expected files written 0 ▶
The install process wrote exactly two files to the skill directory and made no other filesystem changes. No background processes were left running and no new listening ports were opened.
INFO All honeypot canary files confirmed intact 0 ▶
Post-install verification confirms all canary files are unmodified. The credential file reads observed in inotify/auditd logs did not result in content modification.