The Agent Skills Directory

[DATA_EXFILTRATION]: The auth import-browser and auth import-desktop commands are designed to access sensitive local authentication material, including browser cookies and session tokens from various browsers (Chrome, Firefox, Safari, etc.) and the Notion Desktop application. While intended for authentication, this functionality grants the agent access to highly sensitive local credential stores.
[COMMAND_EXECUTION]: The skill executes a custom binary agent-notion which performs network requests to Notion APIs and can modify workspace state. It also utilizes system tools like Grep and Glob to process data.
[PROMPT_INJECTION]: The skill retrieves and processes untrusted data from Notion pages, comments, and databases, which may contain malicious instructions targeting the agent (Indirect Prompt Injection).
Ingestion points: SKILL.md and references/commands.md describe commands like page get --content, database query, and comment list that ingest external data into the agent's context.
Boundary markers: There are no explicit delimiters or instructions to the agent to ignore command-like text within the retrieved Notion content.
Capability inventory: The agent possesses extensive capabilities to modify Notion data (block append, page update, block delete) and interact with Notion AI through the same binary.
Sanitization: While output is structured as NDJSON, the natural language content is not sanitized for potential injection patterns.

agent-notion