The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill utilizes a dynamic code generation pattern in the showProgress function by interpolating a string variable directly into a JavaScript execution block.
Evidence: The serverFunctionName parameter is injected into a template string passed to HtmlService.createHtmlOutput at .${serverFunctionName}();. This allows for arbitrary function invocation within the client-side context of the modal dialog if the function name is derived from an untrusted source.
[INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of external data via UI inputs and prompt dialogs without implementing sanitization or security boundaries.
Ingestion points: User inputs in sidebars (<input id="value">) and prompt dialogs (ui.prompt()) as shown in SKILL.md.
Boundary markers: None present; the skill does not use delimiters or instructions to ignore embedded commands in the processed data.
Capability inventory: The skill has access to UrlFetchApp.fetch for network requests and HtmlService for UI rendering across the provided snippets.
Sanitization: Absent; input retrieved via result.getResponseText() or sidebar elements is used directly without escaping or validation.
[DATA_EXFILTRATION]: The PDF export implementation accesses and transmits sensitive user authentication credentials.
Evidence: The code uses ScriptApp.getOAuthToken() to obtain a Bearer token and includes it in a UrlFetchApp.fetch request. While the target URL is constructed from the active spreadsheet's metadata and targets a standard Google service, this pattern demonstrates the access and handling of sensitive identity tokens that could be targeted for exfiltration.

apps-script-ui