The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: Rule 3 ("Save Everything") instructs the agent to save every insight from every link provided by the user to external storage, regardless of the topic. This creates an attack surface for indirect prompt injection, where malicious instructions embedded in external web content could be ingested and persisted in the agent's long-term memory (Cortex) or project databases.
Ingestion points: External URLs provided during the session (Rule 3 and Rule 5).
Boundary markers: No explicit boundary markers or instructions to ignore embedded commands in the ingested content are present.
Capability inventory: The skill possesses file-writing capabilities (modifying PROJECT-CARD.md and braindump.md) and network access via Notion API tools (mcp__notion__API-post-page) and various search tools (mcp__perplexity__search, mcp__tavily__tavily_search).
Sanitization: The instructions lack any requirement for sanitizing or filtering the content retrieved from external links before storage.
[DATA_EXFILTRATION]: Rule 3 mandates that the agent save information to external Notion databases (IDs: 327d31d1-1b7d-819a-972a-c10f82224289, 326d31d1-1b7d-81bd-b9f1-000bdac0f30b, 31bd31d1-1b7d-810d-a0cf-000beeddeee1). While this is a functional requirement for the project, the "save everything regardless of topic" directive increases the risk of sensitive session data being inadvertently exfiltrated to these external third-party repositories.

marketing-agency