The Agent Skills Directory

[SAFE]: The skill interacts with the official Google Calendar API using well-known, legitimate Python libraries such as google-api-python-client and google-auth. All network operations are conducted over secure channels to official Google domains.
[CREDENTIALS_UNSAFE]: OAuth credentials and tokens are handled securely. The script allows users to configure client secrets via local YAML files and stores session tokens in the system keyring via the keyring library, avoiding hardcoded secrets and plain-text token exposure.
[EXTERNAL_DOWNLOADS]: Dependencies are limited to standard, reputable packages from the Python Package Index (PyPI). No scripts are downloaded from untrusted or remote sources at runtime.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from calendar events (summaries, descriptions) and has write capabilities. This inherent risk is addressed by clear agent instructions to stop and inform the user on errors and the classification of create/update/delete operations as 'write' actions requiring confirmation. Ingestion points include list_events and get_event in scripts/google-calendar.py, while capabilities include create_event, update_event, and delete_event. No specific boundary markers or sanitization logic is implemented for the event content.

google-calendar