notion-security-basics
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill includes functionality to retrieve and display page and database titles from the Notion API, which introduces a surface for indirect prompt injection if the source data is controlled by an untrusted party.
- Ingestion points:
references/token-and-audit.md(theauditIntegrationAccessfunction fetches object titles via thenotion.search()method). - Boundary markers: The example implementation lacks explicit boundary markers or instructions for the agent to ignore potential commands embedded in the retrieved text.
- Capability inventory: The skill leverages the official
@notionhq/clientSDK for API interactions and maintainsBashpermissions fornpmandcurloperations. - Sanitization: Titles are printed directly to the console without sanitization, which could lead the agent to process malicious content as instructions if the output is subsequently read.
Audit Metadata