notion
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection through the processing of untrusted external content.
- Ingestion points: The
notion_fetchtool (SKILL.md) retrieves the full markdown content of external Notion pages. Additionally, theknowledge-capture.mdworkflow specifically instructs the agent to extract and process content from the conversation context. - Boundary markers: The instructions lack explicit boundary markers or directives for the agent to treat fetched content as data rather than instructions. There are no 'ignore instructions within' warnings when processing fetched pages.
- Capability inventory: The skill provides significant write and modification capabilities, including
notion_create_page,notion_append_blocks,notion_update_page, andnotion_update_block(SKILL.md). A malicious instruction hidden in a Notion page could potentially trigger unauthorized edits or data movements across the workspace. - Sanitization: The skill does not implement or mention sanitization, filtering, or validation of the content retrieved via
notion_fetchbefore it is synthesized or used to generate new pages/tasks.
Audit Metadata