notion-migration-deep-dive
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process data from external CSV/JSON files and the Notion API, which serves as a potential ingestion point for untrusted content that could influence agent behavior if not properly delimited.
- Ingestion points: The
importFromCSVfunction inreferences/implementation.mdreads local CSV files viafs.readFileSync, and theexportDatabasefunction in the same file fetches results from the Notion API usingnotion.databases.query. - Boundary markers: There are no explicit boundary markers or delimiters defined in the instructions to separate untrusted external data from agent instructions.
- Capability inventory: The skill utilizes file system access (
fs.readFileSync,fs.writeFileSync) and Notion API write operations (notion.pages.create,notion.blocks.children.append). - Sanitization: The implementation performs schema validation by dropping properties not found in the target database and truncates rich text content to 2000 characters to meet API limits, but it does not include logic to filter or escape potential prompt injection attempts within the migrated content.
Audit Metadata