The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes data from external, untrusted sources such as calendar event titles, notes, and user-provided attachments which could potentially contain malicious instructions.
Ingestion points: SKILL.md (Workflow Step 1) directs the agent to extract event details from "user message, attachment, or source event."
Boundary markers: The instructions lack explicit delimiters or instructions to ignore potential command-like text embedded within retrieved calendar data.
Capability inventory: The agent has permissions to read/write to several calendar APIs, search local configuration directories, and interact with browser-based tools.
Sanitization: There are no specific instructions to sanitize or validate strings extracted from external sources before they are processed or used in further actions.
[CREDENTIALS_UNSAFE]: The skill provides guidance on how to locate and use sensitive credential files on the user's system to restore API connectivity.
Evidence: SKILL.md suggests performing a "bounded search of user configuration folders" for sensitive files such as service-account.json. This is mitigated by a mandatory core rule: "never print keys/tokens or copy them into artifacts."

schedule-management