The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection attacks because it ingests untrusted data from external sources and has powerful write capabilities.
Ingestion points: The agent retrieves potentially attacker-controlled content from calendar event summaries, descriptions, and attendee lists via the list-events and get-event commands.
Boundary markers: There are no explicit instructions or delimiters provided to the agent to distinguish between its own system instructions and the data retrieved from calendar events.
Capability inventory: The skill provides a wide range of capabilities including create-event, update-event, and delete-event, which could be abused if the agent follows malicious instructions embedded in a viewed event.
Sanitization: The instructions do not specify any validation or sanitization of the event content before it is processed by the agent.

google-calendar-automation