The Agent Skills Directory

[COMMAND_EXECUTION]: Use of the pickle module in SKILL.md to store and load authentication tokens from token.pickle. The pickle.load() operation is inherently insecure when dealing with potentially untrusted data, as it can be exploited to achieve arbitrary code execution if the local pickle file is tampered with or replaced by a malicious actor.
[PROMPT_INJECTION]: The skill presents a surface for Indirect Prompt Injection by retrieving and processing content from external communication channels and storage.
Ingestion points: The agent retrieves data from Gmail messages, Google Drive file metadata and content, and Google Sheet values in SKILL.md.
Boundary markers: There are no markers or instructions provided to separate the system context from the untrusted data being ingested from Google Workspace services.
Capability inventory: The skill provides extensive capabilities to perform actions based on ingested data, including sending emails, creating or modifying files, and inserting calendar events.
Sanitization: No validation or sanitization is performed on the data fetched from external sources before it is passed to the agent's context.
[EXTERNAL_DOWNLOADS]: The skill's setup instructions fetch official Google API and authentication libraries from public package registries. It also references the official Google Cloud CLI and suggests using the third-party command-line utilities gdrive and gsheet for resource management.
[DATA_EXFILTRATION]: The skill accesses sensitive local files including credentials.json and token.pickle to manage authentication. It also requests broad OAuth scopes for Gmail, Drive, Sheets, and Calendar, which grants the agent extensive access to private user data. While intended for automation, this level of access represents a significant risk if the agent's behavior is manipulated.

google-workspace