The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill explicitly instructs the user and agent to install the 'notion-cli' tool using the command curl -fsSL https://ntn.dev | bash (found in SKILL.md and references/writing-to-notion.md). This pattern executes an unverified remote script directly in the shell, which is a critical security risk.
[EXTERNAL_DOWNLOADS]: The skill suggests downloading and installing software from sources that are not verified as trusted vendors:
Script download from https://ntn.dev.
Skill installation from https://github.com/makenotion/skills.git.
[CREDENTIALS_UNSAFE]: The skill establishes a protocol for storing sensitive information, including usernames and passwords, in a plain-text markdown file at <project-root>/.agents/credentials/writing-user-guide/CREDENTIALS.md. While it suggests adding this directory to .gitignore, storing secrets in unencrypted files within the project tree exposes them to any process, user, or subsequent agent task that has file system access.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to process data from external, untrusted sources which creates a significant attack surface.
Ingestion points: The skill is instructed to write guides based on JIRA tickets, Slack messages, and engineering notes (documented in SKILL.md).
Boundary markers: There are no instructions provided to use delimiters or to ignore potential instructions embedded within the source materials.
Capability inventory: The agent is empowered to execute shell commands (ntn, playwright-cli), perform network operations, and read/write local files (including the credentials file).
Sanitization: The skill contains no instructions for sanitizing or validating input data before it is processed.
[COMMAND_EXECUTION]: The skill relies on executing external CLI tools (notion-cli and playwright-cli) via subprocesses to perform browser automation and API interactions. Note: playwright-cli is managed by a well-known technology provider.

writing-user-guide