notion-content-management
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill enables the ingestion of untrusted data (user-provided text) into Notion pages and blocks, which can serve as a vector for indirect prompt injection if that content is later read by an agent.
- Ingestion points: External data is incorporated into properties and content blocks via API calls documented in
SKILL.mdand all files in thereferences/directory. - Boundary markers: The instructions do not define boundary markers or provide specific guidance to the agent to treat synchronized data as untrusted or to ignore instructions embedded within the content.
- Capability inventory: The skill facilitates network operations to the Notion API using standard libraries like
@notionhq/clientandnotion-client. No local command execution or sensitive file access capabilities were identified in the analyzed scripts. - Sanitization: The skill lacks explicit sanitization or validation logic for the content being sent to the Notion integration.
Audit Metadata