notion-course-pack-init
Pass
Audited by Gen Agent Trust Hub on Jul 27, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [SAFE]: The skill follows security best practices by utilizing OAuth for authentication and least-privilege access. Documentation in "references/setup-and-capabilities.md" explicitly forbids the agent from requesting, storing, or printing sensitive Notion tokens.
- [COMMAND_EXECUTION]: The skill includes Python scripts for local data processing and uses "subprocess.run" in its test suite ("scripts/tests/test_render_manifest.py") to verify the CLI components. This execution is limited to local scripts and does not involve unsafe shell interpolation or remote command execution.
- [PROMPT_INJECTION]: The skill presents an indirect prompt injection attack surface due to its primary function of processing external documents (books, transcripts, and Notion pages) to create learning routes.
- Ingestion points: External untrusted material is ingested in the "course-init" flow.
- Boundary markers: Content is wrapped in "managed regions" with unique IDs and fingerprints to maintain structural integrity in Notion.
- Capability inventory: The agent can write to Notion pages and local audit files.
- Sanitization: The skill validates the structure of outputs but does not sanitize the contents of processed source materials for embedded instructions.
Audit Metadata