make-note
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted research data and existing Notion notes to automate the creation of summaries and database entries. This architectural pattern is susceptible to indirect prompt injection if the processed research material contains malicious instructions designed to manipulate the agent's summarization or linking logic.
- Ingestion points: Research logs, outputs from the
openspec-exploreskill, and content retrieved from the user's Notion "Personal notebook". - Boundary markers: Limited. While the skill uses call-out blocks to separate new session prompts, it does not define strict delimiters or instructions to ignore embedded commands within the primary research content being summarized.
- Capability inventory: Accesses the Notion MCP connector to create pages, populate database fields (summary, tags, original brief), and manage relations between notes.
- Sanitization: Not present. The instructions do not provide rules for escaping or validating external text before it is written to the persistent Notion database.
Audit Metadata