The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests text from Google Docs, which could contain malicious instructions designed to influence the agent's behavior.
Ingestion points: The get_text function in scripts/docs.py retrieves content from Google Documents through the Google Docs API.
Boundary markers: There are no explicit delimiters or instructions provided to the agent to distinguish between user-provided instructions and content retrieved from documents.
Capability inventory: The skill possesses the ability to create, search, read, and modify (append, insert, and replace text) Google Docs. It does not have capabilities for local file system access or arbitrary command execution.
Sanitization: The implementation extracts plain text from the document's internal JSON structure but does not sanitize the resulting string for potential prompt injection patterns.
[DATA_EXFILTRATION]: The authentication process involves sending sensitive refresh tokens to a non-Google infrastructure.
Evidence: scripts/auth.py sends OAuth refresh tokens to https://google-workspace-extension.geminicli.com/refreshToken to obtain new access tokens. While this is used for the standalone authentication model, it involves sending sensitive credentials to an external third-party service.

google-docs