The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it retrieves and processes content from external sources such as Gmail messages, Google Docs, and Sheets. Ingestion points: Untrusted data from Gmail messages, Google Docs, and Google Sheets is ingested into the agent context via scripts/google_api.py. Boundary markers: The skill does not employ specific delimiters or boundary markers to isolate retrieved data from system instructions. Capability inventory: The agent has the capability to send/reply to emails, create/delete calendar events, and modify spreadsheets. Sanitization: No sanitization or content filtering is applied to retrieved data before it is presented to the agent. Mitigation: SKILL.md includes explicit instructions for the agent to seek user confirmation before performing any sensitive actions like sending emails or deleting events.
[COMMAND_EXECUTION]: The skill executes external commands via the gws (Google Workspace CLI) utility in scripts/google_api.py and scripts/gws_bridge.py. While the execution path is controlled in the main API script, the gws_bridge.py script allows passing arbitrary arguments to the utility, which could be abused if the agent is manipulated into running non-standard commands.
[EXTERNAL_DOWNLOADS]: The scripts/setup.py script includes functionality to install official Google API client libraries (google-api-python-client, google-auth-oauthlib, google-auth-httplib2) using pip. These are well-known official packages.
[SAFE]: The skill implements standard OAuth2 flows for authentication. Sensitive credentials (tokens and client secrets) are stored locally in the user's home directory (~/.hermes/), and network operations for authentication are directed exclusively to official Google API endpoints.

google-workspace