The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill reads content from external Google Sheets, which introduces a surface for indirect prompt injection. If a spreadsheet contains malicious instructions, the AI agent might interpret and execute them as if they were part of its primary directive.
Ingestion points: The readRange function in scripts/gsheets.ts retrieves raw data from cells using the spreadsheets.values.get method, which is then provided to the agent.
Boundary markers: The instructions in SKILL.md do not define clear boundaries or provide guidance for the agent to treat data retrieved from sheets as untrusted content.
Capability inventory: Across its scripts, the skill has the capability to perform network operations via the Google API, read sensitive local credential files (.claude/google-skill.local.json, ~/.config/google-skill/credentials.json), and modify spreadsheet data.
Sanitization: There is no evidence of sanitization or filtering applied to spreadsheet content before it is interpolated into the agent's context, allowing raw strings from cells to be interpreted by the LLM.

gsheets