notion
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from external Notion workspaces, creating a surface for potential instruction injection.
- Ingestion points: Page content and database query results are retrieved using
curlinSKILL.md(e.g.,api.notion.com/v1/blocks/<PAGE_ID>/children). - Boundary markers: The instructions do not define delimiters or provide warnings to the agent to ignore instructions embedded within the retrieved Notion content.
- Capability inventory: The skill has access to the
Bashtool for command execution andWritefor file creation, which could be abused if the agent obeys malicious content from Notion. - Sanitization: There is no evidence of sanitization or filtering applied to the external content before it is processed by the agent or written to files.
- [COMMAND_EXECUTION]: The skill uses the
Bashtool to executecurlcommands andjqfor JSON processing. While these are used for the intended purpose of API interaction, they represent the execution of shell-level operations based on constructed command strings.
Audit Metadata