notion-database-designer
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from user-supplied Notion pages and notes, which could contain malicious instructions.
- Ingestion points: Workflow Step 2 in
SKILL.mdrequires the agent to read supplied notes and lists to infer database outcomes and design tracker structures. - Boundary markers: The prompt instructions do not specify any delimiters or explicit 'ignore' directives to prevent the agent from being influenced by instructions embedded within the user data.
- Capability inventory: The skill uses powerful write-access tools including
create-database,update-data-source,create-pages, andupdate-page(as listed in the evaluation files and workflow steps). - Sanitization: No explicit sanitization, validation, or escaping logic is defined for the content retrieved from external sources before it is interpreted by the agent.
Audit Metadata