notion-spec-to-implementation
Pass
Audited by Gen Agent Trust Hub on Jul 2, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted data from Notion specifications and uses it to perform automated actions.
- Ingestion points: Data enters the context via the
Notion:notion-fetchtool as described in Step 1 of the rules. - Boundary markers: The instructions do not define clear delimiters (like XML tags or specific markdown headers) to separate the untrusted spec content from the agent's instructions.
- Capability inventory: The skill possesses the ability to write back to the external service using
Notion:notion-create-pagesandNotion:notion-update-page. - Sanitization: There are no instructions provided to sanitize, validate, or ignore instructions embedded within the fetched Notion content.
- [EXTERNAL_DOWNLOADS]: The skill provides instructions for setting up a Model Context Protocol (MCP) server from a remote source.
- Evidence: Rule 1 in the Notion MCP setup section directs the user to run
codex mcp add notion --url https://mcp.notion.com/mcp. - Context: This references an official domain for Notion, a well-known technology service.
Audit Metadata