The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data which could contain malicious instructions designed to influence the agent's behavior.
Ingestion points: The skill reads external content via gws gmail +triage, gws gmail users messages get, gws docs documents get, and gws sheets +read across various recipes and personas.
Boundary markers: There are no explicit instructions or delimiters provided to the agent to distinguish between its system instructions and the untrusted data it processes.
Capability inventory: The skill grants the agent significant capabilities, including sending emails (gws gmail +send), posting to Chat spaces (gws chat +send), and modifying Drive permissions (gws drive permissions create).
Sanitization: Although the gws CLI supports content filtering via Model Armor (--sanitize), its use is optional and not enforced in the standard recipes or persona instructions, leaving the agent vulnerable to following instructions embedded in emails or documents.
[COMMAND_EXECUTION]: The skill is designed around the execution of the gws CLI tool. While this is the primary purpose of the skill, it provides a functional surface area for an agent to execute shell commands with various flags and parameters based on potentially untrusted input.

google-workspace