notion-mcp
Warn
Audited by Gen Agent Trust Hub on Aug 16, 2026
Risk Level: MEDIUMPROMPT_INJECTIONNO_CODE
Full Analysis
- [SAFE]: The skill is comprised solely of Markdown documentation. No executable scripts, binaries, or configuration files (such as package.json or requirements.txt) are present in the provided files.- [METADATA_POISONING]: The skill metadata in SKILL.md contains a deceptive description claiming to be the 'Official Notion Model Context Protocol Server'. As the author ('dokhacgiakhoa') is a third-party developer not affiliated with Notion Labs, this claim is misleading and could cause users to misjudge the skill's origin and security status.- [INDIRECT_PROMPT_INJECTION]: The skill defines several tools for ingesting external data from Notion workspaces, which creates a vulnerability surface where adversarial content could influence the agent's behavior.
- Ingestion points: The tool definitions in sub-skills/search.md, sub-skills/retrieve_block_children.md, sub-skills/retrieve_database.md, and sub-skills/query_database.md pull data from external Notion pages and databases into the agent context.
- Boundary markers: The skill documentation does not provide instructions for delimiters or boundary markers to distinguish untrusted Notion content from system instructions.
- Capability inventory: The skill includes the ability to write back to Notion (append_block_children) but does not expose high-risk capabilities like local shell access, file system writes, or arbitrary network communication.
- Sanitization: There are no specifications for sanitizing or validating the content retrieved from the Notion API before it is processed by the agent.
Audit Metadata