gog-appscript
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions for executing the
gogCLI tool to perform Apps Script operations. It emphasizes safety by recommending the use of--readonly,--dry-run, and--no-inputflags to prevent accidental or unauthorized mutations of Google data. - [INDIRECT_PROMPT_INJECTION]: The skill addresses the risk of processing untrusted data from external Apps Script projects.
- Ingestion points: External content is retrieved using the
contentandpullcommands as documented inSKILL.md. - Boundary markers: The documentation recommends using the
--wrap-untrustedflag to properly scope external content for the agent. - Capability inventory: The skill leverages the
gogCLI for project management and execution. - Sanitization: The
--wrap-untrustedflag is highlighted as a best practice to ensure that external content is handled safely within the agent's context.
Audit Metadata