notion
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install the
@notionhq/clientpackage via npm. This is the official SDK for a well-known service and is considered a safe dependency. - [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of data from external sources (such as GitHub PRs and Jira tickets) into Notion databases and pages. This creates a potential surface for indirect prompt injection where malicious instructions embedded in external tickets could influence agent behavior.
- Ingestion points: Data retrieved via
notion.databases.queryinSKILL.md(e.g., within thegetUrgentSprintTasksfunction). - Boundary markers: The provided code snippets do not implement specific delimiters or warnings to ignore instructions embedded in the retrieved data.
- Capability inventory: The skill includes write capabilities such as
notion.pages.createandnotion.blocks.children.appendwhich could be used to persist injected content. - Sanitization: The examples do not demonstrate explicit sanitization or filtering of the content retrieved from the Notion API before processing it.
Audit Metadata