notion-doc-workflow
Pass
Audited by Gen Agent Trust Hub on Oct 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local CLI tool called
ntnto perform operations on the Notion API. - Evidence: The script
scripts/fix-notion-citation-rich-text.pyusessubprocess.runto callntn apifor fetching and patching page blocks. The script includes logic to normalize and validate page IDs via regular expressions (normalize_page_id) before execution, reducing the risk of command injection. - [INDIRECT_PROMPT_INJECTION]: The skill ingests block content from Notion pages to perform rich-text fixes, which is a potential surface for indirect prompt injection.
- Ingestion points: The
list_blocksfunction inscripts/fix-notion-citation-rich-text.pyfetches content from external Notion pages. - Boundary markers: No specific delimiters are implemented to isolate page content during the citation-fix process.
- Capability inventory: The skill has the ability to read and modify Notion documents via the
ntnCLI tool. - Sanitization: The script uses specific regex patterns (e.g.,
r"\[+(\d+)") to identify and fix citation markers structurally, rather than interpreting or executing the page text as instructions.
Audit Metadata