The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains an indirect prompt injection surface as it is designed to ingest and process untrusted data from Gmail, Drive, and Sheets without explicit boundary markers.
Ingestion points: Retrieval of external data occurs through gws gmail users.messages list, gws drive files list, and gws sheets spreadsheets.values get as documented in SKILL.md.
Boundary markers: The instructions lack explicit delimiters or instructions for the agent to ignore potentially malicious instructions embedded in the retrieved content.
Capability inventory: The skill can execute local Python scripts, run shell commands via the gws CLI, and send outgoing emails through gws gmail users.messages send.
Sanitization: No evidence of data sanitization or input validation is present in the provided command sequences before processing external content.
[COMMAND_EXECUTION]: The skill relies on the execution of multiple system commands and local Python scripts, including scripts/gws_doctor.py, scripts/output_analyzer.py, and scripts/workspace_audit.py.
[EXTERNAL_DOWNLOADS]: The skill documentation provides instructions for installing the gws CLI from the npm registry (@anthropic/gws), the Cargo registry (gws-cli), and official binaries from the Google Workspace GitHub repository.
[DATA_EXFILTRATION]: The skill's architecture combines read access to sensitive user data (emails, files, calendars) with the ability to write or transmit data (sending emails, uploading to Drive), creating a potential pathway for data exfiltration if the agent processes malicious data containing exfiltration instructions.

google-workspace-cli