The Agent Skills Directory

[PROMPT_INJECTION]: The skill demonstrates an indirect prompt injection surface by ingesting untrusted data from an external Notion database.\n
Ingestion points: Project 'Goal', 'Requirements', and 'Acceptance Criteria' fields are fetched from Notion via notion-fetch (SKILL.md).\n
Boundary markers: Absent. The instructions do not define any delimiters or safety boundaries to separate external data from the skill's instructions.\n
Capability inventory: The agent is granted Bash, Write, Read, notion-update-page, and notion-update-data-source tools, which could be abused if the Notion content contains malicious instructions (SKILL.md).\n
Sanitization: Absent. There is no mention of sanitizing or escaping the content retrieved from Notion before it is used to generate implementation plans or perform research tasks.\n- [COMMAND_EXECUTION]: The workflow involves executing Bash(mkdir *) commands using paths derived from Notion property strings. While the instructions advise the agent to convert these to kebab-case and remove special characters, the reliance on the agent to perform this sanitization before passing arguments to a shell command creates a potential command injection vector if the Notion properties are maliciously crafted.

spec-generator