notion-opportunity-database
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill acts as a bridge between an external Notion database and other execution skills, creating a surface for indirect instructions to influence agent behavior.
- Ingestion points: The skill fetches schema and row data from external Notion databases via MCP/API tools (SKILL.md).
- Boundary markers: There are no instructions to the agent to disregard or delimit potentially malicious text within the Notion rows.
- Capability inventory: The skill has the ability to update database pages, change schemas, and execute local scripts (SKILL.md).
- Sanitization: No sanitization or validation logic is specified for the data retrieved from the Notion database.
- [COMMAND_EXECUTION]: The instructions explicitly suggest the creation and execution of local scripts to interact with the Notion API as a workaround for tool limitations.
- Evidence: Under the 'MCP Query Limitation' section, the skill instructs: 'use the official Notion API database-query endpoint from a local script instead of the broken MCP SQL wrapper.'
Audit Metadata