The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted data from external emails and attachments.
Ingestion points: The skill uses gmail_search and gmail_get_attachments to retrieve content from third-party senders, which can then be processed by the agent.
Boundary markers: The instructions do not define explicit boundary markers or delimiters to differentiate between legitimate user instructions and potentially malicious content embedded in the email bodies or attachments.
Capability inventory: The skill has access to tools for modifying the Google Workspace environment, such as gdrive_upload, gmail_apply_label, and gmail_archive.
Sanitization: There is no mention of sanitization or validation protocols for the external content before it is processed by the agent.

gmail-workflows