The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the user to download and install external libraries via the mops package manager.
Evidence: Commands such as mops add googlecalendar-client@0.3.0, mops add google-oauth@0.2.1, and mops add caffeineai-authorization@1.0.1 in the SKILL.md file.
Note: Automated scanner alerts for mops.one URLs are identified as false positives, as these represent the official registry for the Motoko ecosystem.
[INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of untrusted data from an external API which could be used as an attack vector if the agent processes the content of calendar events.
Ingestion points: The listUpcomingEvents function in src/backend/lib/calendar.mo fetches event data (summaries, IDs, etc.) from the Google Calendar API.
Boundary markers: The provided code snippets do not include explicit delimiter-based sanitization for the content of the event summaries fetched from the API.
Capability inventory: The skill includes capabilities to make network requests to Google APIs and store data within the canister state.
Sanitization: No specific input sanitization or instruction-ignoring wrappers are mentioned for the external event data processed by the agent.

connector-googlecalendar