notion-spec-to-implementation
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection as it is designed to ingest and parse untrusted data from external sources to influence its output and actions.
- Ingestion points: The skill fetches the full content of specification pages from Notion using the
Notion:notion-fetchtool, as described inSKILL.mdandreference/spec-parsing.md. - Boundary markers: The instructions lack explicit boundary markers or directives to the agent to ignore or isolate instructions that might be embedded within the text of the fetched specifications.
- Capability inventory: The agent possesses the capability to create new pages (
Notion:notion-create-pages) and update existing ones (Notion:notion-update-page) based on the parsed content. While it does not have direct shell access in this context, it can be manipulated into creating misleading or malicious task descriptions in a shared workspace. - Sanitization: There is no evidence of sanitization, filtering, or validation of the content extracted from the specification pages before it is interpolated into implementation plans and task databases.
Audit Metadata