The Agent Skills Directory

[COMMAND_EXECUTION]: Multiple scripts within the skill, such as gws_doctor.py, auth_setup_guide.py, and workspace_audit.py, use the subprocess module to execute system commands via the gws CLI. This is the intended functional mechanism but introduces risks associated with system-level execution.
[DYNAMIC_EXECUTION]: The gws_recipe_runner.py script executes shell commands using subprocess.run(shell=True). While the command templates are hardcoded in the script's RECIPES dictionary, the use of a shell to process these commands is a less secure practice than executing them as a list of arguments, as it could potentially lead to shell injection if parameters are unsafely interpolated in future versions or by the agent.
[EXTERNAL_DOWNLOADS]: The skill directs users to install the @anthropic/gws package from npm and the gws-cli from Cargo. These references point to official package registries and established organizations, which is considered a safe and standard distribution method for CLI tools.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from external Google Workspace APIs, creating an attack surface for indirect prompt injection.
Ingestion points: Data enters the context via gws commands that list Gmail messages, Drive files, and spreadsheet values (e.g., in scripts/output_analyzer.py and scripts/workspace_audit.py).
Boundary markers: There are no explicit delimiters or safety instructions used to wrap retrieved content to prevent it from being interpreted as instructions by the agent.
Capability inventory: The skill provides the agent with high-privilege capabilities, such as sending emails, managing file permissions, and updating user accounts via the admin API.
Sanitization: External content is parsed as JSON/NDJSON but is not sanitized for malicious natural language patterns before being processed.

google-workspace-cli