The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies on the gws CLI tool being present on the system path to interact with Google Workspace APIs. It provides numerous patterns for generating and executing shell commands for authentication (gws auth login), resource management, and complex multi-service workflows.
[PROMPT_INJECTION]: The skill possesses a significant indirect prompt injection surface due to its core functionality.
Ingestion points: The agent is instructed to read content from untrusted external sources such as Gmail messages (gws gmail +read), Google Drive files (gws drive files get), Google Docs (gws docs documents get), and Google Meet transcripts (gws meet conferenceRecords ... list).
Boundary markers: While SKILL.md advises the agent to confirm high-risk writes and check target recipients, there are no explicit prompt delimiters or instruction isolation patterns provided for when external data is interpolated into the agent's context.
Capability inventory: The agent has extensive permissions to perform sensitive actions based on processed data, including sending emails (gws gmail +send), posting to Chat spaces (gws chat +send), sharing files (gws drive permissions create), and modifying Google Apps Script projects (gws script +push).
Sanitization: The skill recommends the use of the --sanitize <TEMPLATE> flag with the gws CLI to screen responses through Model Armor for PII and content safety, which provides some mitigation against data exposure.

gws