The Agent Skills Directory

[Indirect Prompt Injection] (HIGH): The skill provides a high-impact surface for Indirect Prompt Injection (Category 8) by processing external untrusted data with privileged tools.
Ingestion points: The read command (via scripts/gmail.ts) fetches full email bodies, and the list command fetches snippets and headers.
Boundary markers: Absent; there are no delimiters or instructions to ignore embedded commands in the processed emails.
Capability inventory: Possesses write/delete capabilities including send, send-md, draft, and delete (for calendar events).
Sanitization: No sanitization or filtering logic is documented for the ingested email content.
[Data Exposure] (HIGH): The skill accesses sensitive local configuration files and private communication (Category 2).
Evidence: It reads credentials from ~/.config/google-skill/credentials.json and stores authentication tokens in .claude/google-skill.local.json.
[Command Execution] (MEDIUM): Uses npx tsx to execute local TypeScript scripts for all operations (Category 4/10).
Evidence: All primary functions are implemented via calls to npx tsx ${CLAUDE_PLUGIN_ROOT}/scripts/gmail.ts.

gmail