notion-knowledge-capture
Pass
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted conversation context to generate documentation pages and update existing Notion indexes. This ingestion of external data creates a surface for indirect prompt injection, where malicious instructions hidden in a discussion could manipulate the agent to perform unauthorized Notion operations, such as modifying unrelated pages or creating deceptive links.
- Ingestion points: Conversation history and chat context extracted in SKILL.md (Step 1).
- Boundary markers: Absent. The instructions do not define clear delimiters for untrusted data or provide warnings to ignore potential instructions embedded within the extracted text.
- Capability inventory: The skill utilizes Notion integration tools, including Notion:notion-search, Notion:notion-create-pages, Notion:notion-fetch, and Notion:notion-update-page.
- Sanitization: Absent. The skill extracts information and directly interpolates it into markdown templates without sanitization.
Audit Metadata