The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill fetches arbitrary text from a Notion database (titles, descriptions, and discussion logs) and interpolates it directly into the system prompt ('kickoff brief') for sub-agents. This content is untrusted and could be used to inject malicious instructions into the agent's execution context. * Ingestion points: The Description section and Discussion log from Notion tasks are retrieved via scripts/query-tasks.py and the notion-fetch tool, then processed in the start command logic. * Boundary markers: While the brief uses Markdown headers for structure, it lacks explicit boundary markers or instructions to the agent to ignore or isolate instructional language found within the fetched content. * Capability inventory: The sub-agents created by the skill have access to powerful tools like Bash and the Notion MCP, which could be abused if the agent is successfully injected. * Sanitization: No sanitization or filtering for prompt injection patterns is performed on the data retrieved from Notion before it is passed to the LLM.
[COMMAND_EXECUTION]: The skill executes a local Python script (scripts/query-tasks.py) to communicate with the Notion API and process task data. It also utilizes npx to run the Notion MCP server.
[EXTERNAL_DOWNLOADS]: The skill relies on the @notionhq/notion-mcp-server package, which is an official tool from Notion (a well-known service). It also makes network requests to api.notion.com to manage task data.

agency-os