The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill provides instructions for handling Google Service Account credentials via the @gpc-cli/auth package, including loading keys from files or environment variables like GPC_SERVICE_ACCOUNT.
[EXTERNAL_DOWNLOADS]: The documentation guides users to download and install external Node.js packages @gpc-cli/api and @gpc-cli/auth from the npm registry.
[COMMAND_EXECUTION]: The scripts/detect_gpc.mjs script performs environment detection by executing shell commands such as gpc --version and gpc auth status using execSync.
[PROMPT_INJECTION]: The skill creates a surface for indirect prompt injection by facilitating the retrieval and processing of untrusted content from the Google Play Store.
Ingestion points: Data enters the agent's context through methods like client.reviews.list and client.listings.get documented in SKILL.md and references/api-reference.md.
Boundary markers: The provided code examples lack explicit boundary markers or instructions to treat retrieved data as untrusted content.
Capability inventory: The skill possesses state-changing capabilities, such as client.reviews.reply and client.edits.commit, which could be targeted by an injection attack.
Sanitization: There is no evidence of content sanitization or validation for the retrieved data before it is used in logic or displayed to the user.

gpc-sdk-usage