notion-mcp

Warn

Audited by Gen Agent Trust Hub on Aug 16, 2026

Risk Level: MEDIUMPROMPT_INJECTIONNO_CODE
Full Analysis
  • [SAFE]: The skill is comprised solely of Markdown documentation. No executable scripts, binaries, or configuration files (such as package.json or requirements.txt) are present in the provided files.- [METADATA_POISONING]: The skill metadata in SKILL.md contains a deceptive description claiming to be the 'Official Notion Model Context Protocol Server'. As the author ('dokhacgiakhoa') is a third-party developer not affiliated with Notion Labs, this claim is misleading and could cause users to misjudge the skill's origin and security status.- [INDIRECT_PROMPT_INJECTION]: The skill defines several tools for ingesting external data from Notion workspaces, which creates a vulnerability surface where adversarial content could influence the agent's behavior.
  • Ingestion points: The tool definitions in sub-skills/search.md, sub-skills/retrieve_block_children.md, sub-skills/retrieve_database.md, and sub-skills/query_database.md pull data from external Notion pages and databases into the agent context.
  • Boundary markers: The skill documentation does not provide instructions for delimiters or boundary markers to distinguish untrusted Notion content from system instructions.
  • Capability inventory: The skill includes the ability to write back to Notion (append_block_children) but does not expose high-risk capabilities like local shell access, file system writes, or arbitrary network communication.
  • Sanitization: There are no specifications for sanitizing or validating the content retrieved from the Notion API before it is processed by the agent.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Aug 16, 2026, 03:34 AM
Security Audit — agent-trust-hub — notion-mcp