The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches configuration and interacts with official Google APIs (googleapis.com), which are well-known and trusted services. Setup instructions include standard package installation via npm.
[COMMAND_EXECUTION]: The skill includes a cli.js wrapper that uses spawnSync to execute its own internal scripts (cli.ts or dist/cli.js). This is a standard entry point for this type of integration and does not execute arbitrary external commands.
[CREDENTIALS_SAFE]: The skill correctly avoids hardcoding secrets. It instructs users to provide credentials via environment variables or through a Zapier-managed OAuth connection, adhering to security best practices.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from Google Tasks (titles, notes). It mitigates risks by using Zod schemas for strict output validation and providing structured JSON responses to the agent.
[SAFE]: No malicious patterns, obfuscation, or persistence mechanisms were detected. The skill is authored by Zapier and interacts only with vendor-owned or well-known infrastructure.

google-tasks