The Agent Skills Directory

[COMMAND_EXECUTION]: The SKILL.md file provides instructions for executing the Python script via the command line to trigger the email sequence, which is expected behavior for this utility.
[CREDENTIALS_UNSAFE]: The Python script includes logic in its local testing block to load Google OAuth2 credentials from a file named token.json. While this file contains sensitive data, reading it for local development purposes is a standard practice and the script does not perform any unauthorized exfiltration.
[EXTERNAL_DOWNLOADS]: The script depends on the official google-api-python-client and google-auth libraries to interact with Gmail services. These are well-known, trusted dependencies from Google.
[DATA_EXPOSURE]: The script ingests client information (name, email, company) and uses it to populate email templates. This data enters the agent context through the payload argument in scripts/welcome_client_emails.py. There are no specific boundary markers for this untrusted data, and no sanitization is applied before interpolation. However, since the script follows a deterministic procedural flow and does not execute the resulting strings as code or feed them back into an LLM for decision-making, the security risk is negligible.

welcome-email