The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to read content from external sources (Notion pages and databases) and bring it into the agent's context, creating a potential surface for indirect prompt injection if those sources contain malicious instructions.
Ingestion points: Data is ingested via curl calls to the Notion API's search, page reading, and database query endpoints.
Boundary markers: There are no explicit delimiters or instructions provided to the agent to treat the fetched Notion content as untrusted data.
Capability inventory: The skill has access to the Bash tool (for network and file operations) and the publish_artifact tool.
Sanitization: The provided recipes use jq --arg to safely interpolate text into JSON payloads, which effectively mitigates common command and JSON injection vulnerabilities when writing data back to the API.
[COMMAND_EXECUTION]: The skill utilizes the Bash tool to execute curl and jq commands for API communication. These commands are well-defined, target the official Notion API domain, and follow standard security practices for shell-based API interaction.
[DATA_EXPOSURE_AND_EXFILTRATION]: The skill uses a $NOTION_TOKEN environment variable to authenticate with the API. This is a secure method for handling OAuth bearer tokens and does not involve hardcoded credentials. All network operations are directed to api.notion.com, which is the official endpoint for a well-known service.

notion