The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill provides instructions to install the ntn CLI by piping a remote script from https://ntn.dev directly into bash. This pattern allows for the execution of arbitrary, unverified code on the host system without prior inspection.
[METADATA_POISONING]: The skill documentation falsely claims that ntn is "Notion's official CLI". Official Notion developer resources and tools are hosted on notion.so or notion.com (e.g., developers.notion.com). There is no evidence that the ntn.dev domain or the ntn package on npm are official Notion properties, making these claims deceptive and potentially leading users to trust unverified software.
[INDIRECT_PROMPT_INJECTION]: The skill enables the agent to fetch and process arbitrary content from Notion pages via /markdown endpoints. This creates a vulnerability surface where malicious instructions embedded in a Notion page could influence the agent's behavior during summarization or processing tasks.
Ingestion points: Reading page metadata, markdown content, or block children from the Notion API (SKILL.md).
Boundary markers: None present; content is processed directly without delimiters or instructions to ignore embedded commands.
Capability inventory: The skill has capabilities to execute shell commands (ntn, curl) and perform file operations (ntn files create).
Sanitization: No sanitization or validation of the fetched Notion content is implemented before it is passed to the agent context.
[EXTERNAL_DOWNLOADS]: The skill facilitates the download of external software from unverified sources, including the ntn.dev domain and the ntn package via npm. These sources are not recognized as official Notion distribution channels.
[COMMAND_EXECUTION]: The instructions rely heavily on executing shell commands (ntn, curl) that handle sensitive integration tokens, providing a path for potential abuse if these tools are malicious or compromised.

notion