The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/gws_recipe_runner.py uses subprocess.run with shell=True to execute pre-defined Google Workspace commands from an internal recipe dictionary. While the commands are static, the use of a shell-interpolated execution environment is a known security surface that could be exploited if the script's logic is modified to handle external input.
[EXTERNAL_DOWNLOADS]: The skill identifies and facilitates the download of the gws CLI from the @anthropic/gws NPM package and the googleworkspace/cli GitHub repository. These sources are associated with the intended functionality and established vendors.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it reads and processes content from external sources, such as Gmail messages and Drive files, which could contain malicious instructions.
Ingestion points: External data is ingested through various service commands in scripts/workspace_audit.py and scripts/gws_recipe_runner.py.
Boundary markers: The skill relies on JSON/NDJSON formatting and the scripts/output_analyzer.py tool to structure data, but does not include explicit instructions for the agent to disregard embedded commands.
Capability inventory: The skill possesses significant capabilities, including shell command execution, email transmission, and file system modifications via the gws CLI.
Sanitization: There is no evidence of content sanitization or filtering for the data retrieved from Google Workspace APIs.

google-workspace-cli