gog-sheets
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill documentation provides instructions for using the
gogCLI to interact with the Google Sheets API. It lists subcommands for both reading data (get, raw, export) and modifying spreadsheets (update, append, delete-tab). - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data originating from external Google Sheets spreadsheets (SKILL.md).
- Ingestion points: Untrusted data enters the agent context via the
gog sheets getandgog sheets rawcommands. - Boundary markers: The instructions explicitly mandate the use of the
--wrap-untrustedflag when the agent reads Google content to prevent the LLM from executing instructions hidden in cells. - Capability inventory: The tool possesses write and delete capabilities across the Google Sheets API (e.g.,
update,delete-tab,batch-update). - Sanitization: The skill promotes least privilege by recommending the
--readonlyflag for non-mutating tasks and requiring explicit confirmation before any write or delete operations.
Audit Metadata