The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of data from Notion pages and databases, which are untrusted external sources. If these sources contain malicious instructions, the agent could be manipulated into performing unintended actions.
Ingestion points: Data enters the context via the mcp__notionApi__* toolset when performing searches, retrieving page details, or reading block content as described in SKILL.md.
Boundary markers: The instructions do not provide explicit delimiters or warnings to prevent the agent from obeying instructions embedded within the retrieved Notion content.
Capability inventory: The skill is configured to allow high-impact tools such as Bash, Write, and Edit, which could be exploited if an indirect injection is successful.
Sanitization: There is no evidence of filtering or sanitization logic to strip potential instructions from the data fetched from the API.
[COMMAND_EXECUTION]: The skill environment allows access to the Bash tool. While this is used for automation purposes, it provides a powerful interface that should be monitored for abuse, especially when combined with untrusted inputs.

notion-automation