The Agent Skills Directory

[PROMPT_INJECTION]: Potential query injection in scripts/gw.py. The drive_customer command interpolates user-provided input from the --name argument directly into a Google Drive API query string without sanitization. Ingestion points: args.name in scripts/gw.py. Boundary markers: None; input is not validated or escaped. Capability inventory: Searching and listing Google Drive files. Sanitization: Absent; single quotes in input can manipulate query logic.
[CREDENTIALS_UNSAFE]: The skill accesses a sensitive service account JSON file specified by the GOOGLE_SERVICE_ACCOUNT_FILE environment variable and uses domain-wide delegation to impersonate Workspace users. While required for the skill's primary functionality, this access pattern involves handling high-privilege authentication credentials that should be carefully managed.

google-workspace