notion-incident-runbook

Pass

Audited by Gen Agent Trust Hub on Sep 12, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes kubectl, aws, and gcloud CLI commands to perform administrative tasks such as service restarts and secret updates during incident mitigation. These capabilities are restricted to the tools specified in the skill's allowed-tools configuration.
  • [EXTERNAL_DOWNLOADS]: The instructions recommend the installation of official libraries, including notion-client for Python and @notionhq/client for Node.js, to interact with the Notion platform.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external endpoints to classify incidents, creating a potential vector for indirect prompt injection.
  • Ingestion points: The notion-triage.sh script in references/triage.md fetches data from status.notion.so and api.notion.com using curl.
  • Boundary markers: No explicit instructions are provided to the agent to ignore instructions embedded within the fetched data.
  • Capability inventory: The skill has significant execution capabilities, including kubectl for cluster management and curl for network requests.
  • Sanitization: The triage scripts use jq to extract specific JSON fields (e.g., status descriptions and user names), which acts as a primary filter to prevent raw external content from dominating the agent's context.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 12, 2026, 01:47 PM