notion-spec-to-implementation
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest untrusted data from external Notion pages, which presents an attack surface for indirect prompt injection where malicious instructions could be embedded in the specifications.
- Ingestion points: External content is brought into the agent's context through the
Notion:notion-fetchtool as outlined inSKILL.mdandreference/spec-parsing.md. - Boundary markers: The instructions lack explicit boundary markers or system-level directives to treat the fetched content strictly as data, increasing the risk that the model will follow instructions embedded within the spec.
- Capability inventory: The skill has broad capabilities within the Notion workspace, including
notion-search,notion-fetch,notion-create-pages, andnotion-update-page, allowing for potential unauthorized creation or modification of data if an injection is successful. - Sanitization: No sanitization, filtering, or validation steps are performed on the content retrieved from Notion before it is processed by the agent.
Audit Metadata