notion
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFENO_CODEINDIRECT_PROMPT_INJECTION
Full Analysis
- [NO_CODE]: The skill consists entirely of natural language instructions in markdown format and does not include any scripts, binaries, or external dependencies.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process content from external Notion pages, which represents a potential attack surface for indirect prompt injection. However, the skill includes several safety-oriented instructions to mitigate this risk, such as requiring explicit user intent for write operations and mandating that the agent verify target destinations before performing updates.
- Ingestion points: Notion search results, page content, and data source records (SKILL.md).
- Boundary markers: The instructions do not specify explicit delimiters for external content within the agent's context.
- Capability inventory: search, fetch, create, update, and move operations on Notion pages and data sources (SKILL.md).
- Sanitization: The agent is instructed to resolve the destination first, fetch existing content before updating, and limit mutations strictly to requested fields (SKILL.md).
- [SAFE]: The skill follows the principle of least privilege by explicitly excluding administrative and destructive operations, such as database deletion or schema redesign, from its scope. It also emphasizes using allowlisted operations and live schema discovery to prevent unauthorized actions.
Audit Metadata