notion-knowledge-capture
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFENO_CODEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes arbitrary conversation context to generate documentation, which is a standard surface for indirect prompt injection. While the skill is designed for documentation, malicious instructions in the chat could theoretically influence how the agent formats or organizes content in Notion.
- Ingestion points: The skill is instructed to extract key concepts, decisions, and how-to information from the preceding chat context (
SKILL.md). - Boundary markers: There are no explicit instructions for the agent to use delimiters or to ignore instructions embedded within the conversation history.
- Capability inventory: The skill uses
Notion:notion-search,Notion:notion-fetch,Notion:notion-create-pages, andNotion:notion-update-pageto interact with the user's workspace. - Sanitization: No explicit content sanitization or filtering is described in the workflow instructions.
- [NO_CODE]: The skill consists entirely of Markdown instructions, reference documentation, and JSON evaluation files. It does not include executable scripts, binaries, or external package dependencies, significantly limiting its attack surface.
Audit Metadata