notion-spec-to-implementation
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external Notion pages, creating an attack surface for indirect prompt injection. (1) Ingestion points: Specification content is fetched via the Notion:notion-fetch tool as described in SKILL.md and reference/spec-parsing.md. (2) Boundary markers: The instructions do not specify delimiters to isolate ingested specification text from agent instructions. (3) Capability inventory: The agent has the ability to write to the workspace using Notion:notion-create-pages and Notion:notion-update-page. (4) Sanitization: The skill does not perform explicit sanitization or validation of the fetched content.
- [EXTERNAL_DOWNLOADS]: The skill setup involves connecting to the Notion MCP at https://mcp.notion.com/mcp, which is an official service endpoint provided by a well-known organization.
Audit Metadata