notion
Warn
Audited by Gen Agent Trust Hub on Mar 12, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes shell commands including
curlto interface with the Notion API and file system utilities (mkdir,echo,cat) for managing its local configuration and credential storage. - [DATA_EXFILTRATION]: The skill accesses the sensitive local file path
~/.config/notion/api_keyto retrieve the Notion API key. While this key is used to authorize legitimate requests to the official Notion API (a well-known service), accessing local credential files is a sensitive capability that requires review. - [PROMPT_INJECTION]: The skill has an indirect prompt injection surface as it retrieves and processes content from external Notion pages and databases that could contain malicious instructions.
- Ingestion points: API responses from Notion endpoints (e.g., page blocks and database queries) as specified in
SKILL.md. - Boundary markers: No delimiters or explicit safety instructions are used to differentiate Notion data from system instructions.
- Capability inventory: The skill possesses the ability to execute network requests and shell commands via
curl. - Sanitization: No validation or sanitization of content fetched from the Notion API is performed before processing.
Audit Metadata