The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted data from external sources and possesses the capability to perform actions based on that data.
Ingestion points: External data enters the agent's context in scripts/google_api.py via gmail_get (reading email bodies), docs_get (reading document content), and drive_search (retrieving file metadata).
Boundary markers: While the instructions in SKILL.md explicitly require the agent to confirm destructive actions with the user before execution, there are no technical boundary markers or instructions to ignore embedded commands within the scripts themselves.
Capability inventory: The skill provides significant write capabilities in scripts/google_api.py, including gmail_send, gmail_reply, calendar_create, sheets_update, and sheets_append.
Sanitization: The scripts do not perform sanitization, filtering, or instruction-detection on the data retrieved from the Google APIs.
[COMMAND_EXECUTION]: The setup script performs localized environment management using shell commands.
Evidence: scripts/setup.py uses subprocess.check_call to execute pip install for its dependencies.
[EXTERNAL_DOWNLOADS]: The skill downloads official libraries from public registries during its setup phase.
Evidence: The setup.py script installs google-api-python-client, google-auth-oauthlib, and google-auth-httplib2 from the Python Package Index (PyPI).

google-workspace