notion
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes content from Notion pages and databases, creating an inherent attack surface for indirect prompt injection if an attacker places malicious instructions within the workspace.
- Ingestion points: Data is ingested via
notion-search,notion-fetch, and other dynamically discovered tools mentioned inSKILL.md. - Boundary markers: The skill does not define specific delimiters or instructions to ignore embedded commands in the ingested Notion data.
- Capability inventory: The skill provides capabilities to read from and write to the Notion workspace and makes network calls to the Notion MCP server.
- Sanitization: No custom sanitization is performed on the retrieved data before it is presented to the agent.
- [EXTERNAL_DOWNLOADS]: The skill connects to Notion's official hosted MCP server at
https://mcp.notion.com/mcpfor tool discovery and execution. This is an expected behavior for an MCP integration with a well-known service.
Audit Metadata