The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill requires the installation of the keyring Python package to handle secure credential storage on the host system.
[DATA_EXFILTRATION]: The authentication implementation in scripts/auth.py transmits sensitive OAuth refresh tokens to a third-party endpoint (https://google-workspace-extension.geminicli.com/refreshToken). This design introduces a dependency on external, non-Google infrastructure for managing long-lived user credentials.
[DATA_EXFILTRATION]: The send and create-draft commands in scripts/gmail.py have the capability to read any local file specified as an attachment using the open() function and os.path.expanduser. If the agent is compromised or influenced by malicious instructions, this could be used to exfiltrate sensitive files from the local filesystem via email.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted external data by reading the content of incoming emails, which could contain malicious instructions designed to exploit the agent's capabilities.
Ingestion points: The get_message function in scripts/gmail.py fetches the full body and snippet of Gmail messages.
Boundary markers: Absent. The skill returns raw email content to the agent without delimiters or instructions to ignore embedded commands.
Capability inventory: The skill has broad permissions including sending emails, creating/sending drafts, modifying labels (archiving/deleting), and reading local files for attachments.
Sanitization: None. The skill decodes message data but does not filter or sanitize the content for potential injection attacks.

gmail