The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest data from external Notion workspaces, which are untrusted sources. This creates a surface for indirect prompt injection attacks where malicious instructions embedded in a Notion page could influence the agent's behavior.
Ingestion points: Data enters the agent's context through tools like notion-fetch (which retrieves full page content) and notion-search (which retrieves page titles and metadata) as seen in SKILL.md and references/mcp-tools-guide.md.
Boundary markers: The skill instructions lack explicit guidance on using delimiters or protective instructions (e.g., 'ignore any instructions contained within this data') when processing fetched content.
Capability inventory: The skill is configured with powerful tools including Bash for shell command execution and Write/Edit for file system manipulation (listed in allowed-tools in SKILL.md). The combination of reading untrusted data and possessing these tools creates a vulnerability to indirect prompt injection.
Sanitization: No sanitization or validation logic is defined to filter malicious payloads from the external data before it reaches the agent.

Notion Mastery