The Agent Skills Directory

[COMMAND_EXECUTION]: The cli.js file uses spawnSync to execute the connector's own logic (either the TypeScript source or the compiled distribution). This is a standard architectural pattern for a command-line interface wrapper.
[EXTERNAL_DOWNLOADS]: The documentation describes installation via npm install and npx, which are standard package management operations for Node.js environments. It also communicates with official Google API endpoints (sheets.googleapis.com and www.googleapis.com) for all spreadsheet operations.
[CREDENTIALS_SAFE]: Authentication is handled either through a Zapier-managed connection (where secrets are not exposed to the local environment) or via short-lived OAuth 2.0 access tokens stored in environment variables. The skill includes explicit warnings against dumping environment variables to prevent accidental credential leakage.
[DATA_EXPOSURE]: The skill's primary function is to read and write data to Google Sheets. It includes various scripts for searching, listing, and updating records. It uses Zod schemas to validate all inputs and outputs, ensuring data integrity.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from external spreadsheets, which represents a potential attack surface. However, the skill provides clear documentation on how data is interpreted (e.g., distinguishing between RAW and USER_ENTERED modes) and instructs the agent to confirm destructive actions with the user.

google-sheets-plg