notion-webhooks
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references standard package managers (npm, pip) to install common libraries such as Express, FastAPI, and Dotenv. It also recommends using the
hookdeck-clifor local development, which is a utility provided by the skill's author to facilitate webhook testing through local tunneling. - [INDIRECT_PROMPT_INJECTION]: The skill provides templates for creating webhook endpoints that ingest data from external sources (Notion workspace events).
- Ingestion points: The
POST /webhooks/notionroute handler in the provided Express, FastAPI, and Next.js examples. - Boundary markers: The examples demonstrate parsing structured JSON data but do not implement specific LLM boundary markers within the handler logic itself.
- Capability inventory: The code samples are limited to logging event data and contain no dangerous capabilities such as arbitrary command execution or unauthorized network operations.
- Sanitization: The implementation uses standard JSON parsing libraries to validate the structure of the incoming payload before processing.
Audit Metadata