notion-spec-to-implementation

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). Outsider-authored free text can enter the LLM context when the skill fetches the spec page content via Notion:notion-fetch (the spec is authored by someone other than the operating user, and its body text is parsed into requirements/acceptance criteria).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill declares a required Notion MCP endpoint (https://mcp.notion.com/mcp) in agents/openai.yaml and the workflow uses Notion:notion-search / Notion:notion-fetch at runtime to retrieve spec pages whose contents are injected into the agent context and directly control the agent's prompts/actions.