The Agent Skills Directory

[SAFE]: The skill acts as a documentation resource for generating Google Apps Script (GAS) code to automate Google Sheets and Workspace apps.
[DATA_EXFILTRATION]: The skill documents how to send data via email (MailApp.sendEmail) and external APIs (UrlFetchApp.fetch). These findings are categorized as safe as they are fundamental to the skill's primary purpose of automation and report distribution, and use standard platform APIs.
[CREDENTIALS_UNSAFE]: The skill follows security best practices by using placeholders (e.g., getApiKey()) rather than hardcoding credentials. It utilizes ScriptApp.getOAuthToken() for authenticating internal requests to Google export services, which is the correct and secure method for handling authentication within the Apps Script environment.
[PERSISTENCE]: The skill explains the use of installable triggers and the Properties Service. These are native platform features used for scheduling workflows and storing configuration, representing intended functionality for the Google Apps Script environment.
[DYNAMIC_EXECUTION]: The skill provides templates for creating custom HTML dialogs and sidebars. It correctly handles the communication between client-side JavaScript and server-side Apps Script using the standard google.script.run interface.

google-apps-script