The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies on the external gcalcli command-line tool to interact with the Google Calendar API. It constructs and executes shell commands for various subcommands including agenda, search, add, import, and delete.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external calendar events (such as titles and descriptions) and incorporates this data into shell commands. This creates a potential surface where malicious event content could attempt to influence the agent's behavior.
Ingestion points: Data is fetched via gcalcli agenda and gcalcli search as defined in SKILL.md.
Boundary markers: The instructions suggest using quotes for event titles in commands, but do not provide explicit sanitization for shell special characters.
Capability inventory: The skill has full access to the gcalcli tool, which can create and delete calendar data.
Sanitization: There is no dedicated sanitization logic beyond basic quoting of title strings.
[DYNAMIC_EXECUTION]: The skill dynamically generates shell command strings at runtime based on user intent and calendar data. Specifically, it uses a shell piping pattern (echo '...' | gcalcli import) to handle complex event creation (ICS format) via standard input.

gcalcli-calendar