agent-notion
Warn
Audited by Gen Agent Trust Hub on Aug 31, 2026
Risk Level: MEDIUMDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [DATA_EXFILTRATION]: The skill includes authentication commands (
agent-notion auth import-desktopandagent-notion auth import-browser) that extract sensitive Notion session credentials (token_v2) directly from the application data directories and browser cookie stores on the local filesystem. This includes access to profiles from browsers such as Chrome, Firefox, Safari, and Edge. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted content from Notion pages, databases, and comments which may contain malicious instructions designed to influence the agent's behavior.
- Ingestion points:
SKILL.md(commands:page get,block list,database query,comment list). - Boundary markers: Absent. The instructions do not define specific delimiters or security warnings to separate untrusted Notion content from the system context.
- Capability inventory:
SKILL.md(commands:page update,page trash,page archive,block append,block update,block delete,block replace). These capabilities allow an attacker controlling Notion content to potentially manipulate the workspace or perform destructive actions. - Sanitization: Absent. There is no evidence of input validation or content filtering specified in the instructions.
- [COMMAND_EXECUTION]: The skill relies on the execution of the
agent-notionbinary via the Bash tool to perform its operations.
Audit Metadata