notion-research-documentation

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The skill’s runtime path uses Notion:notion-search and Notion:notion-fetch to ingest readable text from Notion pages authored by other people (outsider content) into the agent’s LLM context for synthesis and citation.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill declares and uses the Notion MCP endpoint (https://mcp.notion.com/mcp) at runtime to perform Notion:notion-search / Notion:notion-fetch operations, meaning remote Notion page content is fetched and injected into the agent's context and can directly influence prompts/results.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (medium risk: 0.60). The skill directs the agent to add/enable a remote MCP, edit a local config.toml, and perform login commands—operations that modify local configuration and enable remote access, so it changes machine state and poses moderate risk even though it doesn't request sudo or create users.