notion-automation

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). The required workflow relies on Notion MCP tool calls (e.g., NOTION_FETCH_BLOCK_CONTENTS, NOTION_RETRIEVE_PAGE, NOTION_QUERY_DATABASE) that return page/database/comment text authored by other people, which would be ingested into the agent’s LLM context as readable prose at runtime.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill instructs adding the MCP endpoint "https://rube.app/mcp" to the client and to call RUBE_SEARCH_TOOLS to fetch current tool schemas at runtime, meaning that remote content from that URL will be fetched and can directly control tool prompts/behavior.