The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external data from Notion (task titles, descriptions, and discussion logs) to generate kickoff briefs for AI agents. This creates a surface for indirect prompt injection if the Notion workspace contains malicious instructions.
Ingestion points: Data is ingested through the Notion MCP tools and the scripts/query-tasks.py script which queries the Notion API.
Boundary markers: The skill uses Markdown headers (e.g., ## Description, ## Latest discussion entry) to separate data sections in the generated briefs.
Capability inventory: The skill possesses the capability to execute shell commands (python3), write to local files (todo-ids.json), and perform mutations in the connected Notion workspace.
Sanitization: The briefs embed the latest discussion entries and task descriptions verbatim, with no specific sanitization or escaping of the content beyond simple truncation.
[EXTERNAL_DOWNLOADS]: The skill requires the @notionhq/notion-mcp-server package, which is downloaded and executed via npx during setup. This dependency originates from the official Notion organization, which is a well-known and recognized service.
[COMMAND_EXECUTION]: The skill utilizes a local Python script (scripts/query-tasks.py) to synchronize tasks. This script is executed via the Bash tool to query the Notion API and update the local state. The script uses standard libraries and performs legitimate synchronization tasks without suspicious side effects.
[CREDENTIALS_SAFE]: The skill correctly instructs the user to store sensitive integration tokens (NOTION_TOKEN) in a .env file and ensures that the script loads these credentials from the environment or the local .env file rather than hardcoding them.

agency-os