notion-core-workflow-b
Pass
Audited by Gen Agent Trust Hub on Mar 25, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill implements functions to read content from Notion pages and comments, which introduces an indirect prompt injection surface. Instructions embedded in Notion blocks could potentially influence the agent's behavior when it processes that data.
- Ingestion points: The
getPageContent,getBlockTree, andlistCommentsfunctions inSKILL.mdingest external data from the Notion API into the agent's context. - Boundary markers: The code snippets do not utilize delimiters or specific instructions to the agent to disregard instructions found within the retrieved content.
- Capability inventory: The skill provides capabilities to write, edit, and delete Notion content, and has access to bash and file system tools which could be exploited if the agent follows injected instructions.
- Sanitization: There is no evidence of text sanitization or validation of the retrieved block content before it is processed.
- [SAFE]: The skill uses the official
@notionhq/clientlibrary to interact with Notion, which is a well-known and trusted service for this use case. Use of theNOTION_TOKENenvironment variable is a standard security practice for managing credentials.
Audit Metadata