The Agent Skills Directory

[SAFE]: No malicious patterns, obfuscation, or unauthorized access attempts were detected. The skill's primary purpose is to provide structured templates and a delivery mechanism for Google Chat notifications.
[DATA_EXFILTRATION]: The skill uses the fetch API in assets/webhook-sender.ts to POST data to a webhook URL. This network activity is limited to its intended function of message delivery. There is no evidence of harvesting sensitive local files or environment variables.
[CREDENTIALS_UNSAFE]: No hardcoded secrets or API keys were found. The documentation in SKILL.md explicitly instructs users to manage their webhook URLs as environment variables or secrets rather than hardcoding them, which is a recommended security practice.
[REMOTE_CODE_EXECUTION]: The skill does not download or execute external scripts, nor does it use dynamic execution functions like eval() or exec().
[INDIRECT_PROMPT_INJECTION]: While the skill facilitates the agent sending data to an external service, it does not ingest untrusted data in a way that would lead to unauthorized capability access. It acts as a formatting and delivery layer.

google-chat-messages