SkillsAdd

tychohq/agent-skills

gog-safety

Build and deploy safety-profiled gogcli binaries with compile-time command removal.

First seen May 3, 2026

Installation

$ npx skills add tychohq/agent-skills --skill gog-safety
View on skills.sh ↗ GitHub repository ↗

Summary

  • Build and deploy safety-profiled gogcli binaries with compile-time command removal.
  • Use when setting up gog for an AI agent with restricted permissions — choosing between L1 (draft only), L2 (collaborate), or L3 (standard write).
  • Covers building from PR #366, deploying to remote hosts, and verifying blocked commands.

Similar popular skills

Related neighbors and high-traction skills in the same topics — useful to compare before installing.

agent-browser Shared topics
vercel-labs/agent-browser

Browser automation CLI for AI agents. Use when the user needs to interact with websites, includ…

810.4K installs
vercel-react-best-practices Shared topics
vercel-labs/agent-skills 697.8K installs
web-design-guidelines Shared topics
vercel-labs/agent-skills

Review UI code for Web Interface Guidelines compliance. Use when asked to "review my UI", "chec…

617.3K installs
microsoft-foundry Shared topics
microsoft/azure-skills

Build, deploy, evaluate, optimize, fine-tune, and manage Microsoft Foundry agents, models, and …

576.5K installs
azure-hosted-copilot-sdk Shared topics
microsoft/azure-skills 440.4K installs
azure-enterprise-infra-planner Shared topics
microsoft/azure-skills

Architect and provision enterprise Azure infrastructure from workload descriptions. For cloud a…

402.8K installs

Also in this package

Other skills from tychohq/agent-skills · top by installs.

npx skills add tychohq/agent-skills
amazon 129 flights 106 system-watchdog 91 domain-check 18 tmux 17 architecture-research 17 diagrams 16 research 16 deslop 15 commit 15

Browse all from tychohq/agent-skills

More details

Agent compatibility

Declared targets from SKILL.md / docs. Unmarked agents are not listed — the skill may still install via the CLI.

Claude Code Not declared
Cursor Not declared
Codex Not declared
GitHub Copilot Not declared
Windsurf Not declared
Gemini CLI Not declared
Cline Not declared
OpenCode Not declared

Repository health

License MIT
Default branch main
Open issues 0
Status Active

Skill metadata

Parsed from SKILL.md frontmatter.

Version1.0.0

Package contents

Files included with this skill beyond the listing page.

  • skill md SKILL.md 3,080 B
  • docs SUMMARY.md 338 B

History

  1. First seen on skills.sh
  2. First recorded snapshot · 5 installs

SKILL.md

gog Safety Profiles

Build and deploy gog binaries with compile-time command removal. Commands that are disabled don't exist in the binary — no runtime bypass possible.

Quick Start

1. Choose a safety level

Level Use case Can send email/chat?
L1 Email triage, drafting, inbox organization No
L2 L1 + commenting, RSVP, collaborative work No
L3 Full write access, no dangerous admin ops Yes

For full details: references/levels.md

2. Build

# Build for current platform
./scripts/build-gog-safe.sh L1

# Cross-compile for Linux ARM64 (e.g., AWS Graviton)
./scripts/build-gog-safe.sh L1 --arch arm64 --os linux

# Custom output
./scripts/build-gog-safe.sh L2 --output /tmp/gog-l2

Requires: Go 1.22+, git. First run clones the PR #366 branch (~30s).

3. Deploy

# Deploy to a remote host via SSH
./scripts/deploy-gog-safe.sh spock /tmp/gogcli-safety-build/bin/gog-l1-safe

# Deploy with verification (tests blocked + allowed commands)
./scripts/deploy-gog-safe.sh spock /tmp/gogcli-safety-build/bin/gog-l1-safe --verify

The deploy script:

  • Backs up the existing gog as gog-backup
  • Installs the new binary
  • Verifies version output
  • Optionally tests that blocked commands are gone and allowed commands work

4. Rollback

ssh <host> 'sudo mv /usr/local/bin/gog-backup /usr/local/bin/gog'

How It Works

Uses gogcli's compile-time safety profiles feature (PR #366 on steipete/gogcli). A YAML file specifies which commands are enabled (true) or removed (false). The build system generates Go source files with only the enabled commands, then compiles. The resulting binary's version is tagged with -safe.

YAML Profiles

In references/:

  • l1-draft.yaml — Draft & Organize
  • l2-collaborate.yaml — Draft & Collaborate
  • l3-standard.yaml — Full Write (No Admin)

Custom profiles: copy any YAML, edit the true/false flags, pass to build-gog-safe.sh.

Verification

After deployment, verify with:

ssh <host> "gog --version"                     # Should show -safe suffix
ssh <host> "gog gmail send --help 2>&1"        # Should fail (L1/L2)
ssh <host> "gog gmail drafts create --help"    # Should work (all levels)

Known Edge Cases

  • Filter forwarding: gmail settings filters create is allowed at L1+ for inbox organization. A filter with a forward action could auto-forward email. Accepted risk for v1.
  • Drive sharing: drive share is allowed at L1+ because sharing grants access without sending a message notification. The shared user sees it in "Shared with me" but doesn't get an email.