notion
Pass
Audited by Gen Agent Trust Hub on Sep 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of external data from Notion pages and databases, which can be used as a vector for indirect prompt injection. \n
- Ingestion points: Data enters the agent context through Notion API endpoints for searching, retrieving page details, and fetching block content as described in
SKILL.md. \n - Boundary markers: The instructions do not specify any delimiters or boundary markers to isolate external data from the system's instructions. \n
- Capability inventory: The skill provides instructions for network operations via
curlthat include reading, creating, and updating Notion content, as documented inSKILL.md. \n - Sanitization: The skill lacks any description or mechanisms for sanitizing or validating content retrieved from the external API before processing.
Audit Metadata