notion-webhooks-events
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data retrieved from Notion workspaces and incoming webhook payloads, which constitutes a potential surface for indirect prompt injection.\n
- Ingestion points: Data enters the environment via Notion API calls (
notion.search,notion.databases.query) inreferences/polling.mdand through incoming HTTP POST requests in the webhook receiver scripts inSKILL.mdandreferences/webhooks.md.\n - Boundary markers: The documentation includes security advice to treat webhook payloads as untrusted and provides a
url_verificationhandshake mechanism to validate the source.\n - Capability inventory: The skill operates in an environment with file writing capabilities (
Write,Edit) and shell execution tools (Bash(node:*),Bash(npx:*)), which could be leveraged if the agent inadvertently follows instructions embedded in the synced Notion content.\n - Sanitization: While the scripts include logic for data deduplication and basic type checking, there is no explicit sanitization or filtering of the text content within Notion properties or page blocks to prevent downstream command or prompt injection.
Audit Metadata