Notion助手

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:23 AM UTC
• Version: 1.0.0

Overview

This Notion helper is a small, disclosed integration guide that can read and modify a user's Notion workspace when the user supplies a Notion token and calls the shown methods.

Install only if you are comfortable giving a Notion integration access to selected pages or databases. Prefer using a virtual environment, pinning a reviewed notion-client version, storing the Notion token outside source code, and confirming before running create_page or update_page examples because they change your Notion workspace.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:17

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 4 and 17–19
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

Vulnerable Code

yaml

metadata: {"openclaw": {"requires": {"python": ["notion-client"]}, "install": []}}

bash

pip install notion-client

Technical Analysis

The skill instructs users to install notion-client without pinning a reviewed version or verifying an integrity hash. Consequently, the package version and code executed during installation or runtime may change after this skill has been reviewed.

This creates supply-chain exposure if the package, a maintainer account, or the configured package index is compromised. It may also cause users to receive a future release containing malicious or unexpectedly insecure behavior. The audit found no evidence that the currently named package is malicious; the finding concerns the unsafe dependency-installation practice.

Attack Path

1. An attacker compromises the upstream package, a maintainer account, or the package-distribution channel.
2. The attacker publishes a malicious release under the expected package name.
3. A user follows the skill instructions and runs pip install notion-client.
4. pip selects the attacker-controlled release because no version or hash is specified.
5. Malicious package code executes during installation or when imported by the example.
6. The package may access data available to the Python process, including the Notion integration token supplied to AsyncClient.

Impact Assessment

Successful exploitation could execute code with the privileges of the user running pip or the Python example. Depending on the local environment, this could expose the Notion integration token, accessible local files, environment variables, and Notion resources authorized for that integration. The Notion-side scope would remain bounded by the capabilities and pages granted to the compromised integration token.

Remediation

View remediation

Remediation Suggestions

1. Pin notion-client to a specifically reviewed version:

   bash

   python -m pip install "notion-client==<reviewed-version>"
   

2. Record the same exact version in the skill metadata rather than declaring an unconstrained dependency.
3. Use a lock file or constraints file and require package hashes, for example:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

4. Generate hashes from a trusted release artifact and review dependency updates before changing the pin.
5. Install only from an explicitly trusted package index, preferably in an isolated virtual environment with minimal operating-system privileges.
6. Avoid passing the Notion token in source code; retrieve it from a protected environment variable or secret manager and grant the integration only the minimum required Notion access.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill advertises creating and managing Notion pages and databases but does not clearly warn that it will modify remote user data. In context, the included code supports create and update operations, so a user may invoke the skill without understanding it can write to an external workspace and alter persistent content.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The activation phrases include very broad terms like "Notion", "笔记管理", and "知识库", which can collide with ordinary user requests unrelated to explicit tool use. This increases the chance the skill is invoked unexpectedly and then performs remote actions against a connected Notion workspace, creating a consent and integrity risk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.