The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill demonstrates excellent security posture by providing a production-ready template for verifying Google Chat bearer tokens (templates/bearer-token-verify.ts). It explicitly instructs users to use Cloudflare Workers secrets (via wrangler secret put) for sensitive configuration like webhook URLs and bot tokens, rather than hardcoding them in the source code.
[EXTERNAL_DOWNLOADS]: The skill references the google-chat-cards NPM package and fetches public keys from googleapis.com to perform cryptographic verification of incoming requests. These references target trusted infrastructure and are standard requirements for building secure Google Workspace integrations.
[INDIRECT_PROMPT_INJECTION]: The skill acts as an interface for chat-based interactions, creating a surface where user-supplied data is processed by the agent.
Ingestion points: Data enters through the request.json() call in templates/interactive-bot.ts, processing MESSAGE and CARD_CLICKED event types from the Google Chat platform.
Boundary markers: The templates utilize structured JSON responses for card construction, which inherently separates control flow from data, though they do not include specific natural language delimiters for user text in the basic echo examples.
Capability inventory: The skill is capable of performing network operations via fetch to Google Chat API endpoints for managing messages, spaces, and members.
Sanitization: A dedicated validation utility is provided in templates/form-validation.ts that includes regex patterns and length checks for common input fields like email, phone, and name.

google-chat-api