notion
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests content from Notion pages and databases, which represents an attack surface for indirect prompt injection.\n
- Ingestion points: Content is retrieved from Notion via search results, page block children, and database queries (SKILL.md).\n
- Boundary markers: Absent. No delimiters or instructions are provided to the agent to distinguish between its instructions and the data being processed.\n
- Capability inventory: The skill can create and update pages and blocks using
curlcommands, which could be exploited if malicious instructions are processed.\n - Sanitization: Absent. The skill does not validate or sanitize the data received from the API.\n- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using
curlto interact with the Notion API. It also accesses a specific file path~/.config/notion/api_keyto read the required authentication token.
Audit Metadata