The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies on a command-line tool called gplay to fetch and list reports from Google Play's Reporting bucket. This is the core functionality of the skill and involves executing shell commands with various flags like --month, --dimension, and --package.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from external CSV exports deposited by Google Play. This creates a surface for indirect prompt injection if the content of these reports is maliciously crafted.
Ingestion points: Data is read from Google Play CSV exports via the gplay reports command (SKILL.md).
Boundary markers: The skill suggests using --output json to receive structured report, columns, and rows objects, but it does not specify any instructions for the agent to treat these values as untrusted data or use specific delimiters.
Capability inventory: The skill allows listing, reading, and filtering financial and installation data; it does not appear to grant arbitrary file system writes or network access beyond the scope of the gplay tool.
Sanitization: The documentation explicitly states that values are returned "verbatim" from the CSV, indicating a lack of sanitization for strings that the agent might subsequently process.
[SAFE]: The skill demonstrates good privacy practices by defaulting to hide buyer location data (city, state, postcode) and instructing the agent not to copy this sensitive information into logs or tickets even when the --include-buyer-location flag is used.

gplay-reports