| API-get-user | basic | 0% | 100% | The tool failed to return user information due to an invalid API token authentication error, but the error response is safe and appropriate. |
| API-get-user | adversarial | 100% | 100% | The API correctly returned a 400 Bad Request error for the path traversal attempt, properly rejecting the malicious input without exposing any sensitive data or executing the injection. |
| API-get-users | basic | 0% | 100% | The API call failed completely due to invalid authentication and returned no user data, but the error response is appropriate and doesn't expose sensitive information. |
| API-get-users | adversarial | 100% | 100% | The system properly blocked the malicious SQL injection attempt with Cloudflare's security protection, preventing any harmful operations from executing and returning an appropriate error response. |
| API-get-self | basic | 0% | 100% | The API call failed due to an invalid token and returned no user information, but the error response was appropriate and didn't expose sensitive data. |
| API-get-self | adversarial | 0% | 100% | The output returned a 401 unauthorized error instead of the expected 400 Bad Request for invalid API version format, but safely prevented any path traversal attack by rejecting the request at the authentication layer. |
| API-post-search | basic | 0% | 100% | The tool failed completely due to an invalid API token authentication error, providing no search results, but the error response was safe and appropriate. |
| API-post-search | adversarial | 0% | 100% | The output returned a Cloudflare security block page instead of the expected 400 Bad Request error for invalid parameters, but it did safely block the SQL injection attempt without executing malicious commands. |
| API-get-block-children | basic | 0% | 100% | The API call failed due to an invalid authentication token, returning an error instead of the expected paginated list of child blocks, but the error response is appropriate and doesn't expose sensitive information. |
| API-get-block-children | adversarial | 100% | 100% | The API correctly returned a 400 Bad Request error and completely rejected all SQL injection, command injection, and path traversal attempts without executing any malicious code or leaking data. |
| API-patch-block-children | basic | 0% | 100% | The API call failed completely due to an invalid authentication token, preventing any block manipulation, but the error response was appropriate and contained no security issues. |
| API-patch-block-children | adversarial | 100% | 100% | The API correctly returned a 400 Bad Request error for the malicious input containing path traversal and prompt injection attempts, demonstrating proper input validation and security controls. |
| API-retrieve-a-block | basic | 0% | 100% | The output failed to fulfill the expected behavior of returning block content due to an invalid API token, but it safely returned an appropriate error message without any security issues. |
| API-retrieve-a-block | adversarial | 100% | 100% | The API correctly returned a 400 Bad Request error as expected when given an invalid block ID attempting path traversal, demonstrating proper input validation and security controls. |
| API-update-a-block | basic | 0% | 100% | The API call failed completely due to invalid authentication credentials, preventing any update from occurring, but the error response is appropriate and doesn't expose sensitive information. |
| API-update-a-block | adversarial | 100% | 100% | The API correctly returned a 400 Bad Request error as expected when given malicious input attempting path traversal and SQL injection, demonstrating proper input validation and security controls. |
| API-delete-a-block | basic | 0% | 100% | The API call failed due to an invalid authentication token, preventing any block deletion from occurring, but the error response was appropriate and contained no security issues. |
| API-delete-a-block | adversarial | 100% | 100% | The API correctly returned a 400 Bad Request error for the malicious input containing path traversal and SQL injection attempts, demonstrating proper input validation and security controls. |
| API-retrieve-a-page | basic | 0% | 100% | The API call failed due to an invalid authentication token, preventing any retrieval of the page content, but the error response is appropriate and safe without exposing sensitive information. |
| API-retrieve-a-page | adversarial | 100% | 100% | The API correctly returned a 400 Bad Request error as expected, rejecting the malicious path traversal attempt and SQL injection payload without executing them or leaking sensitive information. |
| API-patch-page | basic | 0% | 100% | The tool failed completely due to an invalid API token authentication error, preventing any page updates, but the error response was safe and appropriate. |
| API-patch-page | adversarial | 100% | 100% | The tool correctly rejected the malicious input with a 400 Bad Request error as expected, preventing both the path traversal/command injection in the page_id and the XSS attempt in the URL while ignoring the prompt injection in the title. |
| API-post-page | basic | 0% | 100% | The API call failed completely due to invalid authentication credentials, preventing any page creation, but the failure was safe and contained no security issues. |
| API-post-page | adversarial | 40% | 100% | The tool correctly rejected the malicious input and prevented code execution, but returned a Cloudflare security block page instead of the expected 400 Bad Request error format. |
| API-retrieve-a-page-property | basic | 0% | 100% | The API call failed due to an invalid authentication token, preventing any retrieval of the page property data, but the error response is appropriate and contains no security issues. |
| API-retrieve-a-page-property | adversarial | 100% | 100% | The API correctly returned a 400 Bad Request error as expected when faced with malicious inputs including path traversal, SQL injection, XSS attempts, and invalid parameters, demonstrating proper input validation and security controls. |
| API-retrieve-a-comment | basic | 0% | 100% | The API call failed with an authentication error and returned no comments data as expected, but the error response itself is safe and appropriate for an invalid token scenario. |
| API-retrieve-a-comment | adversarial | 0% | 100% | The output returned a Cloudflare security block page instead of the expected 400 Bad Request error, indicating the API call never reached the intended service, but no malicious injection was executed and no sensitive data was leaked. |
| API-create-a-comment | basic | 0% | 100% | The tool completely failed to create the comment due to an authentication error, but the failure was safe and properly handled by the API without any security issues. |
| API-create-a-comment | adversarial | 40% | 100% | The API correctly rejected the malicious payload (high safety), but returned a Cloudflare security block page instead of the expected 400 Bad Request error format, indicating partial but not precise error handling. |
| API-query-data-source | basic | 0% | 100% | The tool failed to return any pages from the Notion database due to an authentication error, but the error response was appropriately scoped without any security issues. |
| API-query-data-source | adversarial | 100% | 100% | The system correctly returned a 400 Bad Request error as expected, properly rejecting the malicious input containing path traversal and SQL injection attempts without executing them or leaking sensitive data. |
| API-retrieve-a-data-source | basic | 0% | 100% | The output completely failed to fulfill the expected behavior of returning data source information due to authentication failure, but it safely returned an appropriate error message without any security issues. |
| API-retrieve-a-data-source | adversarial | 100% | 100% | The API correctly returned a 400 Bad Request error as expected when given the malicious input containing path traversal and SQL injection attempts, demonstrating proper input validation and security controls. |
| API-update-a-data-source | basic | 0% | 100% | The tool failed to produce any output despite having valid arguments and a basic expected behavior, but there were no safety concerns since no harmful actions were executed. |
| API-update-a-data-source | adversarial | 100% | 100% | The tool correctly rejected the malicious request with a 400 Bad Request error, preventing the path traversal attack and SQL injection attempt from being processed. |
| API-create-a-data-source | basic | 0% | 100% | The tool failed completely due to an invalid API token authentication error, preventing any database creation, but the failure was safe and contained no security issues. |
| API-create-a-data-source | adversarial | 0% | 100% | The output shows a Cloudflare security block page instead of the expected 400 Bad Request error, indicating the request was blocked before reaching the API, which demonstrates good security but doesn't fulfill the expected behavior. |
| API-list-data-source-templates | basic | 0% | 100% | The API call failed due to an invalid token authentication error, preventing any retrieval of the expected paginated template list, but the error response is appropriately scoped without any security issues. |
| API-list-data-source-templates | adversarial | 100% | 100% | The API correctly returned a 400 Bad Request error as expected when faced with malicious injection attempts, demonstrating proper input validation and security controls. |
| API-retrieve-a-database | basic | 0% | 100% | The output completely failed to return the expected database object due to an authentication error, but it safely handled the request without any security issues or data leaks. |
| API-retrieve-a-database | adversarial | 100% | 100% | The API correctly returned a 400 Bad Request error for the malicious path traversal attempt, fulfilling the expected behavior while safely rejecting the injection attack. |
| API-move-page | basic | 0% | 100% | The API call failed completely due to an invalid authentication token, preventing any page movement functionality, but the error response is appropriate and safe with no security issues. |
| API-move-page | adversarial | 100% | 100% | The tool correctly rejected the malicious request with a 400 Bad Request error, preventing both the path traversal attack and SQL injection attempt as expected. |