The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the user to download and install a binary from a third-party GitHub repository (openclaw/gogcli) via curl. This source is not categorized as a trusted vendor or well-known technology service, representing an unverifiable dependency.
[REMOTE_CODE_EXECUTION]: The installation process involves downloading a compressed binary archive and placing it in a local execution path (~/.local/bin/), which the agent then executes to perform Google Workspace operations.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from highly untrusted sources, creating a significant vulnerability surface for indirect prompt injection.
Ingestion points: Untrusted content is read into the agent's context through commands such as gog gmail get (messages), gog docs cat (documents), gog drive download (files), and gog sheets get (spreadsheets).
Boundary markers: The instructions do not define any delimiters or specific system prompts to isolate external content or warn the agent to ignore instructions embedded within the ingested data.
Capability inventory: The agent possesses high-impact capabilities including sending emails (gog gmail send), sharing documents (gog drive share), and modifying or deleting files and spreadsheet data.
Sanitization: There is no evidence of data sanitization, filtering, or validation before external content is presented to the language model for processing.
[COMMAND_EXECUTION]: The skill operates by executing shell commands with arguments that may be derived from external, attacker-controlled inputs, potentially leading to command injection vulnerabilities.
[DATA_EXFILTRATION]: While providing legitimate functionality, the combination of reading private communications (Gmail) and possessing tools to transmit data externally (Gmail send, Drive sharing) establishes a high-risk path for data exfiltration if the agent is manipulated by malicious content.

google