The Agent Skills Directory

[DATA_EXFILTRATION]: The skill transmits sensitive OAuth refresh tokens to a third-party endpoint (https://google-workspace-extension.geminicli.com/refreshToken) during token refresh operations when using the default 'cloud' authentication mode. This allows the third-party service to potentially access the user's Google Workspace data by generating new access tokens.
[DYNAMIC_EXECUTION]: The 'scripts/workspace.js' utility executes arbitrary JavaScript code provided by the agent using the Node.js 'vm' module. This execution context is granted access to the authorized Google API client and the user's tokens, creating a path for privilege abuse if the agent is manipulated via prompt injection.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from Google Workspace APIs (e.g., email bodies, document text) without implementing boundary markers or sanitization. This establishes an attack surface where malicious data could influence the agent's behavior.
Ingestion points: API calls in 'scripts/workspace.js' returning raw Google Workspace data to the agent context.
Boundary markers: None present to delimit external data from instructions.
Capability inventory: Includes network calls to Google APIs, token persistence, and dynamic script execution.
Sanitization: API responses are passed directly to the agent context as JSON without filtering or escaping.
[COMMAND_EXECUTION]: The 'scripts/common.js' file includes logic to automatically invoke 'npm install' via 'node:child_process' to install dependencies if they are missing at runtime, which executes external binary code on the host system.
[EXTERNAL_DOWNLOADS]: During its setup process, the skill downloads external packages from the NPM registry to provide its core functionality.

google-workspace