notion
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to use the
ntnCLI for specific tasks like file uploads, Notion Workers management, and raw API discovery. This is a standard administrative interface for Notion integration. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data from Notion resources (pages, databases, comments), which constitutes a vulnerability surface for indirect prompt injection if those resources contain malicious instructions.
- Ingestion points: Notion content retrieved via the MCP connector (e.g.,
notion-fetch) or thentnCLI. - Boundary markers: Not explicitly defined in the instructions for separating untrusted data from the prompt.
- Capability inventory: The skill can write to Notion (creating/updating pages and databases) and execute shell commands via the
ntnCLI. - Sanitization: The skill enforces a pre-flight check that validates content against the
notion://docs/enhanced-markdown-specresource before performing writes.
Audit Metadata