research-management
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and synthesize information from external sources (Notion pages), which creates a surface for indirect prompt injection attacks.
- Ingestion points: The skill uses the
Notion:notion-fetchtool (documented inSKILL.mdandexamples/technical-investigation.md) to read full content from Notion pages which are externally controlled and may contain arbitrary text. - Boundary markers: The instructions do not define delimiters or explicit boundary markers to isolate ingested data from the agent's instructions, nor do they instruct the agent to ignore commands found within the fetched text.
- Capability inventory: The skill has the capability to write synthesized content back to the Notion workspace using
Notion:notion-create-pages, which could be exploited to publish malicious content or perform unauthorized workspace modifications if an injection occurs. - Sanitization: There is no evidence of content sanitization, validation, or filtering of the information retrieved via Notion tools before it is processed and re-shared.
Audit Metadata