| Server / tool | A untrusted | B sensitive | C external |
|---|---|---|---|
| notion / create_a_comment | · | · | ● |
| ↳ create_a_page | · | · | ● |
| ↳ query_data_source | · | ● | · |
| ↳ retrieve_a_comment | ● | · | · |
| ↳ retrieve_page_markdown | · | · | · |
| ↳ search | · | · | · |
| ↳ update_page_markdown | · | · | ● |
This server's combined toolset spans all three lethal-trifecta axes, so an agent using it can be steered to chain them into data exfiltration or unauthorized action. Contributors — A (untrusted-input): notion:retrieve_a_comment; B (sensitive-access): notion:query_data_source; C (external-comms): notion:create_a_page, notion:update_page_markdown, notion:create_a_comment.
✓ Break the trifecta: remove one axis, split capabilities across isolated agents, or require human approval for the state-changing / external-comms step.
ASI02 · Tool Misuse and Exploitation · confidence 75%