The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill installs the @gongrzhe/server-gmail-autoauth-mcp and zod-to-json-schema packages from the NPM registry during the Docker container build process.
[DATA_EXFILTRATION]: Grants the agent broad permissions to interact with a user's Gmail account, including reading messages, searching the inbox, and sending emails. While the skill follows a security best practice by using "onecli-managed" stubs to prevent raw credentials from being stored on disk, the agent effectively gains high-privilege access to sensitive communications.
[PROMPT_INJECTION]: The skill creates a surface for indirect prompt injection attacks because the agent processes untrusted data from incoming emails.
Ingestion points: The mcp__gmail__read_email and mcp__gmail__search_emails tools allow untrusted email content to enter the agent's context.
Boundary markers: There are no explicit instructions or delimiters provided to the agent to treat email content as untrusted or to ignore embedded instructions.
Capability inventory: The agent possesses powerful capabilities, such as send_email and delete_email, which could be abused if the agent is manipulated by malicious content in an email.
Sanitization: The skill does not specify any sanitization, filtering, or validation of the email data before it is presented to the agent.
[COMMAND_EXECUTION]: The setup process involves executing shell commands to modify the local project environment, including updating a central SQLite database (data/v2.db) via a helper script and restarting system services.

add-gmail-tool