The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content retrieved from Notion workspaces, creating a surface for indirect prompt injection attacks.
Ingestion points: Content is ingested via commands like page get --content, database query, block list, comment list, and ai chat get as documented in SKILL.md.
Boundary markers: The skill documentation does not specify the use of delimiters or clear separators to distinguish Notion data from agent instructions.
Capability inventory: The agent has the ability to create, update, trash, and archive pages and blocks, and manage workspace authentication using the agent-notion tool.
Sanitization: There are no documented procedures for sanitizing or validating the content retrieved from Notion before it is processed by the agent.
[COMMAND_EXECUTION]: The skill relies on the execution of the agent-notion binary through the Bash tool, which is allowed by the frontmatter configuration.
[EXTERNAL_DOWNLOADS]: The skill includes functionality to access sensitive local resources, such as browser cookie stores and desktop application data, to import authentication sessions (auth import-desktop, auth import-browser). While these are documented authentication features, they involve reading sensitive local files.

agent-notion