The Agent Skills Directory

[CREDENTIALS_UNSAFE]: OAuth credentials and refresh tokens are transmitted to and processed by a third-party proxy server.
Evidence: scripts/auth.py routes OAuth redirects and token refresh requests through https://google-workspace-extension.geminicli.com.
Security Note: This architecture places a third-party service in the trust chain for the user's Google Workspace credentials.
[DATA_EXFILTRATION]: User authentication tokens are sent to an external domain not managed by the primary service provider. Additionally, the skill's file upload capability could be abused to exfiltrate sensitive local files if the agent is manipulated by external input.
Evidence: scripts/auth.py sends the refresh_token to https://google-workspace-extension.geminicli.com/refreshToken. scripts/chat.py allows uploading arbitrary files via the send-media command.
[INDIRECT_PROMPT_INJECTION]: The skill reads untrusted chat message content, which could contain instructions intended to manipulate the agent's behavior.
Ingestion points: scripts/chat.py functions get_messages, get_message, and list_threads fetch message text into the agent context.
Capability inventory: The agent can send, edit, and delete messages, as well as upload local files to the chat service.
Boundary markers: Output formatting does not utilize specific delimiters or escape sequences to separate untrusted message content from system instructions.
Sanitization: No active filtering or validation of incoming chat text is performed.
[EXTERNAL_DOWNLOADS]: The skill interacts with external domains for authentication and API communication.
Targeted domains: google-workspace-extension.geminicli.com (auth proxy), chat.googleapis.com (API), and accounts.google.com (OAuth).

google-chat