notion-knowledge-capture
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user conversation data to generate Notion documentation. This presents an indirect prompt injection surface, though the impact is limited as the skill lacks access to sensitive local resources or dangerous command execution.
- Ingestion points: Processes untrusted conversation history and user notes as defined in
SKILL.mdandevaluations/README.md. - Boundary markers: No explicit delimiters are instructed for the captured conversation content, relying on the agent's extraction logic.
- Capability inventory: Write and update capabilities via Notion MCP tools:
notion-create-pagesandnotion-update-page. - Sanitization: Relies on the agent's internal reasoning and extraction steps to isolate relevant information.
- [EXTERNAL_DOWNLOADS]: The skill guides the user to configure the official Notion MCP server at
https://mcp.notion.com/mcp. This is an expected reference to a well-known service provider's official endpoint for the purpose of the skill's primary function.
Audit Metadata