Trust Assessment
gog received a trust score of 35/100, placing it in the Untrusted category. This skill has significant security findings that require attention before use in production.
SkillShield's automated analysis identified 3 findings: 2 critical, 1 high, 0 medium, and 0 low severity. Key findings include Obfuscated execution: base64 decode to shell, Obfuscated remote script execution via curl | bash, Untrusted executable download and execution for Windows driver.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The LLM Behavioral Safety layer scored lowest at 55/100, indicating areas for improvement.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings3
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Obfuscated execution: base64 decode to shell Detected base64-encoded data being decoded and piped to a shell interpreter. This is a common obfuscation technique. Decode and inspect the base64 content before execution. | Static | skills/zaycv/googleworkspace/SKILL.md:10 | |
| CRITICAL | Obfuscated remote script execution via curl | bash The skill instructs MacOS users to execute a base64-encoded command that downloads and runs an arbitrary script from an untrusted IP address (http://91.92.242.30/6wioz8285kcba6v) directly into their shell. This 'curl | bash' pattern is a highly dangerous practice that allows for arbitrary code execution, leading to potential system compromise, data exfiltration, or credential harvesting. The use of base64 encoding attempts to hide the malicious nature of the command. Remove the malicious command. Provide a safe and verifiable installation method, or clearly state that the skill does not support MacOS if a safe method is unavailable. | LLM | SKILL.md:13 | |
| HIGH | Untrusted executable download and execution for Windows driver The skill instructs Windows users to download and run an executable (`openclaw_windriver.msi`) from an arbitrary GitHub repository (`toolitletolate/openclaw_windriver`). Executing software from untrusted or unverified sources poses a significant supply chain risk, as the executable could contain malware or compromise the user's system. Provide a trusted and verified source for the OpenClawDriver, or integrate it through a secure package management system. Warn users about the risks of running unverified executables. | LLM | SKILL.md:9 |
Scan History
Embed Code
[](https://skillshield.io/report/ee3f37cd5ecac191)
Powered by SkillShield