notion
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources, specifically Notion pages, databases, and comments, which can be retrieved using the
search.readandpages.readtools described inmanifest.yamlandSKILL.md. - Ingestion points: The agent ingests data from Notion workspace content through the
call-toolinterface. - Boundary markers: The instructions do not specify the use of delimiters or clear boundaries to distinguish between system instructions and data retrieved from Notion.
- Capability inventory: The skill has extensive write capabilities, including
pages.write,comments.write,databases.write,attachments.write,skills.write, andagents.write, which could be abused if the agent follows malicious instructions found in a Notion page. - Sanitization: There is no mention of sanitizing or escaping the data fetched from Notion before the agent processes it.
- Mitigation: The skill includes a human-in-the-loop requirement (Operating Rule 4) stating the agent must confirm user intent before performing any actions that mutate Notion content, which mitigates the risk of unauthorized changes.
Audit Metadata