The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data by reading and searching content from Notion pages, databases, and comments. This creates a surface for indirect prompt injection attacks where adversarial instructions embedded in Notion content could be executed by the agent.
Ingestion points: Data enters the agent's context through the output of notion-cli call-tool when performing search or read operations (e.g., search.read, pages.read).
Boundary markers: The instructions do not explicitly mandate the use of delimiters or specific system prompts to treat Notion content as untrusted data.
Capability inventory: The agent has permissions to mutate the Notion workspace, including creating, editing, or deleting pages, databases, and comments via notion-cli subcommands.
Sanitization: There is no evidence of content filtering or sanitization applied to the raw data retrieved from Notion.
[COMMAND_EXECUTION]: The skill uses the exec tool to run the notion-cli binary. While this is the intended design for the skill, it represents a capability that could be abused if combined with a successful prompt injection.
[SAFE]: Credentials are managed via a standard OAuth flow with PKCE, and tokens are stored in a dedicated, restricted directory ($JARVIS_HOME/user/auth/), which aligns with safe secret management practices.

notion