The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill functions by retrieving content from external Notion pages and blocks, which acts as a potential ingestion point for malicious instructions embedded in that data.
Ingestion points: SKILL.md and references/notion-public.openapi.json define endpoints like get:/pages/{page_id} and get:/blocks/{block_id}/children that pull external data into the agent's context.
Boundary markers: The instructions do not specify the use of delimiters or instructions to disregard commands found within the retrieved data.
Capability inventory: The skill has the capability to modify the workspace via post:/pages, patch:/blocks/{block_id}/children, and delete:/blocks/{block_id}.
Sanitization: There is no documented logic for sanitizing or filtering the content retrieved from Notion before it is processed by the agent.
[EXTERNAL_DOWNLOADS]: The skill configuration fetches an OpenAPI schema from the author's repository (github.com/holon-run/uxc). This is a standard and transparent fetch of a configuration resource from the vendor's own infrastructure.
[SAFE]: The skill follows security best practices by recommending the use of environment variables for secrets and requiring explicit user confirmation before executing write or delete operations.

notion-openapi-skill