The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests and processes untrusted external data to modify workspace content and structure.
Ingestion points: Untrusted data enters the agent context from Notion URLs using notion-fetch and from uploaded requirement files (docx, pdf, md, txt) in the /uploads/ directory, as described in SKILL.md (Step 1) and mode-3-single-task.md (Section 1).
Boundary markers: Absent. The instructions do not define delimiters or specific warnings for the agent to ignore potentially malicious instructions embedded within the requirements or Notion pages being analyzed.
Capability inventory: The skill has significant capabilities to modify the user's environment, including notion-create-pages, notion-update-page, and notion-update-data-source (used for schema modification in epic-ops.md), as well as document generation via referenced vendor skills.
Sanitization: Absent. There is no explicit requirement for the agent to validate or sanitize the content of external requirements before using them to generate new tasks, update existing pages, or modify the database schema.

pm-studio