meeting-record-system
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of data from external sources (Notion pages) that could contain malicious instructions designed to influence the agent's behavior. \n
- Ingestion points: Data enters the agent context through the
Notion:notion-fetchtool, which reads content from project pages, specifications, and previous meeting notes as described inSKILL.md(Step 3). \n - Boundary markers: The instructions lack specific delimiters or system-level directives to treat fetched Notion content strictly as passive data, increasing the risk that the agent may follow instructions embedded within that data. \n
- Capability inventory: The skill possesses the ability to read from the workspace (
notion-fetch) and write new content back to it (notion-create-pages), which could be leveraged in a multi-step injection attack. \n - Sanitization: There is no documented mechanism for sanitizing or validating the text retrieved from Notion before it is interpolated into prompts for document generation.
Audit Metadata