The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exhibits a surface area for indirect prompt injection because it ingests untrusted data from external sources and has the capability to perform follow-up actions based on that data.
Ingestion points: The skill uses Notion:notion-fetch to retrieve content from arbitrary Notion pages.
Boundary markers: The instructions do not define explicit boundary markers (e.g., XML tags or clear delimiters) to isolate fetched content from system instructions, nor do they instruct the model to ignore embedded commands within source pages.
Capability inventory: The skill has write access to the workspace via Notion:notion-create-pages and Notion:notion-update-page, allowing injected instructions to potentially influence the creation of deceptive or malicious documentation.
Sanitization: There is no evidence of content sanitization or validation of the fetched data before it is synthesized into final reports.
[EXTERNAL_DOWNLOADS]: The skill provides instructions for setting up the Notion Model Context Protocol (MCP) server.
Evidence: The workflow in SKILL.md includes the command codex mcp add notion --url https://mcp.notion.com/mcp to add the official Notion MCP tool to the environment.

notion-research-documentation