notion
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONNO_CODE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill defines a workflow where the agent ingests data from external Notion databases via the API, which presents a surface for indirect instructions.
- Ingestion points: Notion API endpoints for querying databases (
/v1/databases/{id}/query) and reading page content as described in the Notion API section. - Boundary markers: The instructions lack explicit delimitation (such as XML tags or triple quotes) or warnings to ignore potentially malicious instructions embedded within user-controlled Notion pages.
- Capability inventory: The agent is granted permission to create and update Notion pages and databases, providing a write-back channel for processed data.
- Sanitization: There are no instructions for sanitizing or escaping content retrieved from Notion before it is interpolated into the agent's context or outputs.
- [NO_CODE]: The skill is purely instructional and contains no scripts, binaries, or dependency files, significantly reducing the direct execution attack surface.
Audit Metadata