The Agent Skills Directory

[SAFE]: The skill is developed by Zapier and interacts exclusively with well-known, trusted technology services (Google and Zapier). It contains no signs of obfuscation, malicious intent, or persistence mechanisms.
[EXTERNAL_DOWNLOADS]: The skill's documentation and installation instructions utilize standard package managers (npm, npx) to fetch dependencies from the official npm registry and authorized Zapier repositories.
[COMMAND_EXECUTION]: The cli.js entry point uses spawnSync to execute the connector's own local files (cli.ts or dist/cli.js). This is a standard architectural pattern for Node.js CLI tools to handle environment checks and runtime dispatching.
[DATA_EXFILTRATION]: The skill communicates with the official Google Tasks API (tasks.googleapis.com) to perform its primary functions. These network operations are directed to a well-known service and are restricted to managing user-authorized task data.
[PROMPT_INJECTION]: The skill ingests untrusted data such as task titles and notes from the Google Tasks API. It mitigates potential indirect prompt injection by using strict Zod schemas to validate all input and output data, ensuring it conforms to expected formats before processing.

google-tasks