The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes data from the Notion API (page titles, database rows, search results) which could contain adversarial instructions. This risk is effectively mitigated by several design choices documented in SKILL.md and scripts/notion-cli:
Ingestion points: Data enters the agent context via the search, pages get, and databases query commands in scripts/notion-cli.
Boundary markers: The skill instructions (SKILL.md) explicitly mandate that the agent summarize page content rather than dumping raw data, and the CLI script automatically truncates long text fields.
Capability inventory: The skill possesses read/write capabilities (pages get/create/update, databases query) via the Notion API.
Sanitization: All mutation commands (create, update) are strictly guarded by a human-in-the-loop confirmation requirement (--dry-run and --yes flags), preventing the agent from autonomously executing instructions found in read data.
[COMMAND_EXECUTION]: The test suite (tests/test_notion_cli.py) uses subprocess.run to verify CLI behavior. This is a benign use of command execution limited to testing the local bundled script within a deterministic environment.
[DATA_EXfiltration]: The skill performs network operations to api.notion.com, which is a well-known service essential for the skill's primary function. The skill correctly instructs users to manage sensitive integration tokens via environment variables (NOTION_TOKEN), adhering to security best practices for credential handling.

notion