The Agent Skills Directory

[PROMPT_INJECTION]: The skill facilitates the ingestion and processing of untrusted data from external sources, creating an indirect prompt injection surface.
Ingestion points: The skill retrieves email content and calendar event details via the Google API helpers in scripts/google_auth.py and scripts/api-notes.md.
Boundary markers: There are no explicit delimiters or instructions provided to the agent to differentiate between user instructions and the data retrieved from external APIs.
Capability inventory: The agent is granted capabilities to read, send, and modify emails and calendar events, which could be abused if malicious instructions are present in processed data.
Sanitization: The provided Python helpers do not include logic to sanitize or filter the content retrieved from Google services before it is passed to the agent's context.
[DATA_EXFILTRATION]: The skill manages and stores sensitive authentication credentials.
Credential Storage: OAuth client secrets and refresh tokens are stored in plain text within the /home/.z/google-oauth/ directory (client_secret.json and token.json). While this is standard for local OAuth implementations, it exposes the credentials to any process with access to the user's home directory.
Network Activity: The skill performs network operations to oauth2.googleapis.com to exchange authorization codes and refresh tokens. These operations target a well-known service and are consistent with the skill's primary purpose.

google-direct-oauth