notion-incident-runbook
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes
kubectl,aws, andgcloudCLI commands to perform administrative tasks such as service restarts and secret updates during incident mitigation. These capabilities are restricted to the tools specified in the skill'sallowed-toolsconfiguration. - [EXTERNAL_DOWNLOADS]: The instructions recommend the installation of official libraries, including
notion-clientfor Python and@notionhq/clientfor Node.js, to interact with the Notion platform. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external endpoints to classify incidents, creating a potential vector for indirect prompt injection.
- Ingestion points: The
notion-triage.shscript inreferences/triage.mdfetches data fromstatus.notion.soandapi.notion.comusingcurl. - Boundary markers: No explicit instructions are provided to the agent to ignore instructions embedded within the fetched data.
- Capability inventory: The skill has significant execution capabilities, including
kubectlfor cluster management andcurlfor network requests. - Sanitization: The triage scripts use
jqto extract specific JSON fields (e.g., status descriptions and user names), which acts as a primary filter to prevent raw external content from dominating the agent's context.
Audit Metadata