The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill provides implementation patterns that ingest data from Notion databases and render it for display or use in other logic, creating an injection surface.
Ingestion points: Untrusted content is ingested from the Notion API using notion.databases.query, notion.blocks.children.list, and notion.search as shown in references/implementation.md.
Boundary markers: The code examples and instructions do not include specific boundary markers or instructions for the agent to ignore commands that might be embedded in the fetched Notion properties or block content.
Capability inventory: The skill facilitates write operations to the Notion API, such as notion.pages.create and notion.pages.update, which could be influenced by malicious data ingested from the source databases.
Sanitization: The blockToHtml utility in references/implementation.md directly interpolates plain_text from Notion blocks into HTML tags (e.g., <p>${text}</p>) without sanitization or escaping, which could lead to XSS or other injection attacks if the Notion content is controlled by an attacker.

notion-architecture-variants