notion
Pass
Audited by Gen Agent Trust Hub on Jul 9, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes
curlcommands to interact with the well-known Notion API service (api.notion.com). This is the intended primary purpose of the skill and uses standard API interaction patterns. - [PROMPT_INJECTION]: The skill contains a surface for indirect prompt injection (Category 8) by ingesting untrusted data from an external source.
- Ingestion points: External content such as Notion page blocks, search results, and database records are retrieved via the
/v1/blocks,/v1/search, and/v1/data_sourcesendpoints inSKILL.md. - Boundary markers: No delimiters or explicit instructions are provided to help the agent differentiate between its own instructions and potentially malicious content retrieved from the Notion API.
- Capability inventory: The skill utilizes shell execution for
curlcommands and reads a specific local file (~/.config/notion/api_key) for credentials. - Sanitization: No sanitization, filtering, or validation is applied to data retrieved from the Notion API before it enters the agent's context.
Audit Metadata