gog is a command-line client for Google Workspace services such as Gmail, Calendar, Drive, Docs, and Sheets. It is used by people, scripts, continuous-integration jobs, and coding agents that need account selection, structured output, and permission controls from a terminal.
Borrowing it
Nothing to install: this file belongs to openclaw/gogcli. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/openclaw/gogcli/main/.agents/skills/gog-appscript/SKILL.mdgit clone --depth 1 https://github.com/openclaw/gogcliWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/openclaw/gogcli/gog-appscript)<a href="https://agentmods.dev/skills/openclaw/gogcli/gog-appscript"><img src="https://agentmods.dev/badge/skills/openclaw/gogcli/gog-appscript/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/openclaw/gogcli/gog-appscript"><img src="https://agentmods.dev/badge/skills/openclaw/gogcli/gog-appscript.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00011 | $0.00319 |
| Opus 5.5 | $0.00004 | $0.00128 |
| Sonnet 5.5 | $0.00002 | $0.00064 |
| Haiku 4.5 | $0.00001 | $0.00032 |
Grade A, and why
gog-appscript scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Apps Script
Use gog for Apps Script operations. Read ../gog/SKILL.md first for shared auth,
output, safety, and live-write rules.
Safe start
gog auth list --check --json --no-input
gog schema appscript --json
gog --readonly --account [email protected] appscript --help
- Select the account explicitly with
--account. - Use
--json --wrap-untrustedfor agent-readable Google content. - Use
--readonlywhen the task must not mutate Google data. - Use
--no-inputin automation and--dry-runbefore supported writes. - Confirm the exact account, object, and mutation before any write or delete.
Commands
| Command | Purpose |
|---|---|
content |
Get Apps Script project content |
create |
Create an Apps Script project |
deployments |
List deployments |
get |
Get Apps Script project metadata |
pull |
Pull an Apps Script project into a local directory |
run |
Run a deployed Apps Script function |
versions |
List versions |
Run gog appscript <command> --help for flags and gog schema appscript <command> --json
for the machine-readable contract. Do not guess command syntax.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 41 lines · 11 tokens per session scan A 911ae3cf2e95
gog-appscript is a skill published in the GitHub repository openclaw/gogcli (8,542 stars, last pushed 2d ago), licensed MIT. It adds 11 tokens to every session and 319 once invoked, about $0.0000 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
google-cloud-solution-n-tier-serverless-web-app
Assists in designing and implementing secure n-tier serverless web applications and microservices on Google Cloud. Use when users need architecture designs, security checklists, Terraform code, or deployment guidance for multi-tier serverless apps, regional data residency / European sovereignty compliance, zero-trust…
gemini-interactions-api
Guides the usage of Gemini Interactions API on Gemini Enterprise Agent Platform. Use when the user wants to use the stateful, server-managed Interactions API for multi-turn conversations, background execution, streaming, structured output, and function calling on the Agent Platform.
api-gateway-mcp-server
Configures Google Cloud API Gateway to act as a remote Model Context Protocol (MCP) server (Public Preview) that exposes REST APIs as agent tools over HTTP (POST /mcp). Use when migrating OpenAPI 2.0 specs to OpenAPI 3.x for MCP, annotating specs with x-google-api-management.mcp and x-google-mcp-tool, securing…
bigquery-udfs
Creates, deploys, and troubleshoots BigQuery User-Defined Functions (UDFs) and Remote Functions across SQL, JavaScript, Python, and Cloud Run endpoints. Use when writing custom scalar or aggregate functions in BigQuery, installing PyPI packages or Cloud Storage libraries in a Python or JavaScript UDF, or calling…
data-manager-api-event-ingestion
Guides developers through implementing event and conversion ingestion to Google products using the Data Manager API /v1/events/ingest endpoint and its associated client libraries. Use this skill when the user wants to upload offline conversions, enhanced conversions for leads, click conversions, Google Analytics web…
dpop-adoption
Implement and debug OAuth 2.0 DPoP (RFC 9449) refresh token sender-constraining for WebCrypto, Node.js ES6, and browser runtimes integrating with Google's OAuth platform. Use when configuring non-extractable asymmetric key pairs (P-256), generating DPoP Proof JWTs for authorization code exchange and token refresh, or…