tasks-build

Name: cursor-notion-plugin/tasks-build
Author: makenotion

Share on X Share on LinkedIn Share on Bluesky

70High

The skill is insecure because it fetches and executes arbitrary instructions from an attacker-controlled Notion page, enabling remote command injection and unauthorized control over the agent's behavior.

ThreatsCI SM CS BC S HITL

Threat Analysis

AI Agent Traps ↗Scanned 6/20/2026

Content InjectionPerception1 finding

Semantic ManipulationReasoningclean

Cognitive StateMemory & Learningclean

Behavioural ControlActionclean

SystemicMulti-Agent Dynamicsclean

Human-in-the-LoopHuman Overseerclean

Skill Info

Namemakenotion/cursor-notion-plugin/tasks-build

Registrygithub

Versioncf1324609edb

PURLpkg:github/makenotion/cursor-notion-plugin@cf1324609edb?skill=tasks-build

Stars17

Installs20

Source

Repository ↗SKILL.md ↗

Install

This skill has been flagged as potentially malicious. Review the findings below before installing.

GitHub

20 installs

Skills.shDocs

npx skills add https://github.com/makenotion/cursor-notion-plugin

Assessments (2)

AI Agent Traps ↗

Indirect prompt injection via Notion contenthighindirect prompt injection

The skill instructs the agent to fetch and follow instructions from an external Notion page, which is an attacker-controllable source. This allows an attacker to inject arbitrary commands into the agent's execution flow by modifying the Notion page content.

90% confidenceline 19

Use the Notion MCP tools to: Get the page content including title, description, and any relevant properties

Missing usage exampleslowpolicy violation

Skill body contains no code blocks or usage examples, making it harder for users to evaluate.

100% confidence

Missing licenseinfopolicy violation

Skill does not specify a license field. Specifying a license helps users understand usage terms.

100% confidence

Badge

Markdown

[![Mondoo Skill Check](https://mondoo.com/ai-agent-security/api/badge/github/makenotion/cursor-notion-plugin/tasks-build.svg)](https://mondoo.com/ai-agent-security/skills/github/makenotion/cursor-notion-plugin/tasks-build)

HTML

<a href="https://mondoo.com/ai-agent-security/skills/github/makenotion/cursor-notion-plugin/tasks-build"><img src="https://mondoo.com/ai-agent-security/api/badge/github/makenotion/cursor-notion-plugin/tasks-build.svg" alt="Mondoo Skill Check" /></a>

Image URL

https://mondoo.com/ai-agent-security/api/badge/github/makenotion/cursor-notion-plugin/tasks-build.svg

Secure your AI agents

Skills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet.

Continuous scanning of skills across all registries
Policy enforcement before skills reach your agents
Integration with your existing security workflow