notion-automate

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Outsider-authored free text can enter the LLM context via the runtime Notion MCP tool responses (e.g., mcp__notion__query_database / mcp__notion__get_page return page bodies, database row text, and block content authored by other people), which the workflow then renders into Markdown and feeds to the parent agent.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill makes runtime calls to the Notion MCP server (mcp.notion.com/mcp) via mcp__notion__* tools to fetch page/database content which is then incorporated into agent prompts and therefore could carry prompt‑injection or other instruction-shaped payloads that directly influence the agent's behavior.