The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The file SKILL.md contains instructions for the user to execute a remote script directly in their shell using curl -fsSL https://ntn.dev | bash. This pattern is highly insecure as the source ntn.dev is not a verified trusted organization, making the system vulnerable to arbitrary code execution if the domain or transmission is compromised.
[EXTERNAL_DOWNLOADS]: The skill recommends the global installation of the ntn package via npm install --global ntn. This package originates from an external registry and its source code is not audited within the provided skill files.
[COMMAND_EXECUTION]: The skill makes extensive use of shell commands, including curl for network requests and the ntn CLI for managing Notion data and deploying Workers. While these are central to the skill's purpose, they provide a powerful execution environment that could be abused if malicious instructions are processed.
[INDIRECT_PROMPT_INJECTION]: The skill specifically facilitates the retrieval of Notion page content in Markdown format to be fed to an AI agent. This creates a vulnerability where malicious content within a Notion page could override agent instructions.
Ingestion points: Notion page and database content retrieved via the /markdown API endpoints in SKILL.md.
Boundary markers: No specific delimiters or "ignore instructions" warnings are suggested for the retrieved data before it is passed to the agent context.
Capability inventory: The skill possesses the ability to execute network requests, modify local configuration files (e.g., ~/.hermes/.env), and deploy remote code to Notion Workers.
Sanitization: There are no instructions for sanitizing or escaping the Markdown content fetched from Notion before the agent processes it.

notion