The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from multiple sources, creating an attack surface where malicious content could attempt to override agent behavior.
Ingestion points: Accesses Gmail messages, Google Drive files, Google Chat messages, Google Docs content, and Google Form responses (identified in SKILL.md and various reference files).
Boundary markers: There are no explicit instructions for the agent to use specific delimiters or to ignore instructions embedded within the processed data.
Capability inventory: The skill possesses powerful capabilities across ALL scripts, including sending emails (gmail.md), sending chat messages (chat.md), modifying files (drive.md, docs.md), and executing Apps Script functions (apps-script.md).
Sanitization: No sanitization or validation logic is specified for the content retrieved from external Google Workspace services.
[COMMAND_EXECUTION]: The skill uses Bash(workspace-cli *) and Bash(uv run workspace-cli *) to interact with its CLI tool. This provides a legitimate but powerful command execution surface for interacting with Google APIs.
[DYNAMIC_EXECUTION]: Through the Google Apps Script tools (run_script_function, manage_script_content), the skill can create, update, and execute arbitrary code within the Google Apps Script environment, which can perform broad actions across the user's workspace.
[DATA_EXFILTRATION]: The skill provides tools for both reading sensitive data (e.g., searching Gmail and reading Drive files) and sending data to external destinations (e.g., sending emails or chat messages). While intended for valid workflows, this toolset provides a path for potential data exfiltration if the agent is misled by malicious input.

managing-google-workspace