Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add CodeInfinity1/Stram --skill goggit clone --depth 1 https://github.com/CodeInfinity1/StramWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/codeinfinity1/stram/gog)<a href="https://agentmods.dev/skills/codeinfinity1/stram/gog"><img src="https://agentmods.dev/badge/skills/codeinfinity1/stram/gog/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/codeinfinity1/stram/gog"><img src="https://agentmods.dev/badge/skills/codeinfinity1/stram/gog.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00030 | $0.01023 |
| Opus 5.5 | $0.00012 | $0.00409 |
| Sonnet 5.5 | $0.00006 | $0.00205 |
| Haiku 4.5 | $0.00003 | $0.00102 |
Grade A, and why
gog scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 147 lines — stays where its author put it; the contents beside it link to each section on GitHub.
gog
Purpose
Operate a locally authenticated Google Workspace CLI only when the user explicitly wants the gog path and approval boundaries are clear. Prefer Stram-native packets and drafts when live CLI execution is not required.
When To Use
Use this skill when the user asks for Gmail, Calendar, Drive, Contacts, Sheets, or Docs work and a local gog CLI is available. For Gmail drafting inside Stram, prefer the native gmail_draft_prepare artifact tool first; use gog only when configured and approved.
Tool Map
gmail_draft_prepareemail_draft_preparexlsx_workbook_createxlsx_workbook_inspectrun_shell_command
Workflow
- Check
gogwith a shell status command such asgog auth list. - If not configured, the user must complete OAuth setup:
gog auth credentials <client_secret.json>gog auth add <account> --services gmail,calendar,drive,contacts,docs,sheets
- Set
GOG_ACCOUNT=<email>to avoid repeating account flags. - Prefer
--jsonand--no-inputfor machine-readable commands. - Prefer native draft/packet tools before live CLI mutation.
- Require explicit approval before sends, calendar creation, sheet mutation, deletes, clears, or sharing changes.
Safety
- Confirm before sending email, creating events, updating sheets, or deleting/clearing data.
- Prefer drafts over sends when wording or recipient identity is unclear.
- Never infer a recipient from a fuzzy name when email address is absent.
- Keep OAuth tokens out of prompts and logs.
Native Implementation Boundaries
- Use Stram native tools for Gmail drafts, email drafts, XLSX artifacts, and operation packets when possible.
- Use
run_shell_commandforgogonly as an approved local CLI adapter path, with exact arguments and no hidden shell expansion. - Treat missing
gog, missing OAuth, ambiguous account state, or non-JSON output as setup/blocker evidence.
Gmail
Native draft artifact:
{"tool_name":"gmail_draft_prepare","tool_input":{"to":["[email protected]"],"subject":"Subject","body":"Body text","reason":"Prepare an approval-ready Gmail draft."}}
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 147 lines · 30 tokens per session scan A bf2c315ae3ea
gog is a skill published in the GitHub repository CodeInfinity1/Stram (11 stars, last pushed 2mo ago), licensed MIT. It adds 30 tokens to every session and 1,023 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
notion-knowledge-capture
Convert conversations and notes into structured, linkable Notion pages for easy reuse.
obsidian
Read, search, create, or edit notes in an authorized Obsidian vault while preserving frontmatter, wikilinks, and unrelated notes.
oracle-confidentiality
Enforce confidentiality across Oracle deliverables — pre-delivery audits, codename enforcement, and content sanitization. Use before any Oracle client handoff, when sanitizing documents, or when checking deliverables for confidential leaks.
create_note
Capture findings or context as a persistent note in the thoughts system.
office-productivity
Office productivity workflow covering document creation, spreadsheet automation, presentation generation, and integration with LibreOffice and Microsoft Office formats.
recipe-create-events-from-sheet
Read event data from a Google Sheets spreadsheet and create Google Calendar entries for each row.