The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses subprocess to manage several legitimate tasks:
scripts/setup.py executes pip install to ensure the required Google API client libraries are available.
scripts/google_api.py and scripts/gws_bridge.py execute the gws (Google Workspace CLI) tool to perform API operations when it is installed on the user's system.
[EXTERNAL_DOWNLOADS]: The scripts/setup.py file facilitates the installation of standard, well-known Python packages from the Python Package Index (PyPI), including google-api-python-client, google-auth-oauthlib, and google-auth-httplib2.
[PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface as it ingests untrusted data from external sources. Evidence chain:
Ingestion points: Untrusted data enters the agent context through Gmail messages (gmail get), Drive files (drive search), and Docs content (docs get) in scripts/google_api.py.
Boundary markers: Absent. The raw text from emails and documents is retrieved and displayed without specific delimiters or instructions to ignore embedded commands.
Capability inventory: The skill has significant write capabilities, including gmail send, calendar create, and sheets update in scripts/google_api.py.
Sanitization: There is no explicit sanitization or filtering of external content before it is processed by the agent. However, SKILL.md includes a mandatory rule requiring user confirmation before any write operations are performed, providing a manual guardrail against automated exploitation.

google-workspace