notion-plan
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill fetches external content from Notion pages which is then presented to the agent and passed to the /design skill. This creates a surface for indirect prompt injection where malicious instructions in a Notion page could influence agent behavior.\n
- Ingestion points: Fetches data from user-supplied Notion URLs (SKILL.md, Step 2).\n
- Boundary markers: Content is formatted into a Markdown template, but no specific boundary markers or instructions to ignore embedded commands are present.\n
- Capability inventory: The skill can execute shell commands and invoke other skills.\n
- Sanitization: No sanitization or filtering of the retrieved Notion content is performed before processing.\n- [COMMAND_EXECUTION]: The skill uses the Bash tool to execute shell commands using the playwright-cli utility.\n
- Evidence: Multiple steps (Step 0, 2a, 2b, 2c, 2d, 2e, 2f) involve executing shell commands with potentially variable arguments like the Notion URL.\n- [DATA_EXFILTRATION]: The skill accesses and stores sensitive session data and page content in the local filesystem.\n
- Sensitive file paths: Notion session data is stored in a persistent profile at ~/.playwright-cli/notion-profile. Page snapshots, which may contain sensitive private data, are saved as YAML files in the .playwright-cli/ directory within the workspace.
Audit Metadata