The Agent Skills Directory

[DYNAMIC_EXECUTION]: The function showProgress generates a client-side script by interpolating the serverFunctionName variable directly into a script block within HtmlService.createHtmlOutput. This implementation creates a surface for dynamic code injection if the function name is not strictly validated or comes from an external source.
[EXTERNAL_DOWNLOADS]: The exportSheetAsPdf function performs a network request using UrlFetchApp.fetch to download a PDF version of the spreadsheet. The request includes an OAuth Bearer token for authentication and targets a URL dynamically constructed from the spreadsheet's own location on Google's trusted domain.
[INDIRECT_PROMPT_INJECTION]: The skill provides UI templates that ingest untrusted user input through ui.prompt() and sidebar input fields. \n- Ingestion points: Input fields in showSidebar and result of ui.prompt(). \n- Boundary markers: None present in the provided templates to delimit untrusted data. \n- Capability inventory: UrlFetchApp.fetch and google.script.run. \n- Sanitization: The templates do not demonstrate input sanitization or validation before processing data server-side.

apps-script-ui