Notion Workspace

The README describes a Notion workspace management skill, but its 'Use when' guidance expands into generic web search, research, source discovery, and content extraction. This scope mismatch can cause the agent to invoke the skill in situations unrelated to Notion, increasing the chance of inappropriate data access or side effects through an over-privileged integration.

The manifest advertises this skill for generic web search, research, source discovery, and content extraction, but the actual capability set is privileged Notion access with OAuth, page/database reads, writes, triggers, and MCP. This scope mismatch can cause an orchestrator or user to invoke the skill in situations where they expected passive information retrieval, leading to unintended access to private workspace data or unintended state-changing actions.

The usage guidance is broad enough that an orchestrator or user may select this skill for many loosely related tasks, not just explicit Notion operations. In a tool-using agent environment, overbroad routing language is dangerous because it can trigger unnecessary credentialed actions or expose workspace contents when a less-privileged capability would suffice.

The README advertises create-page and insert-row capabilities but does not warn that the skill can modify user data. In context, this is risky because an agent may treat the skill as informational while it actually has write capabilities, leading to unintended changes to Notion pages or databases.

The skill's trigger conditions are overly broad and include generic web search and research tasks outside the documented Notion-only scope. In agent environments, broad routing cues can cause this skill to be selected unnecessarily, exposing Notion-connected credentials and workspace data paths when a lower-privilege search tool should have been used instead.

The example payload includes a real-looking email address in the user_id field without any warning about privacy implications or guidance to substitute a non-identifying value. In a documentation skill that users may copy verbatim, this can normalize transmitting personally identifying data to the external AISA service and lead to unnecessary disclosure of user information in logs, telemetry, or third-party systems.

This section explicitly supports broad workspace discovery via search and fetch operations across pages and databases, but provides no instruction to verify user authorization, minimize scope, or warn that results may expose sensitive internal content. In an agent skill, this increases the risk of over-collection and unintended disclosure because a user request like 'find docs' could cause enumeration of workspace data beyond what is necessary.

The workflow documents full page markdown export, block retrieval, schema fetch, and database row queries without any privacy or least-privilege warnings. These operations can retrieve large volumes of sensitive text, metadata, and structured records, so an agent following this workflow could exfiltrate confidential workspace content in response to underspecified or malicious prompts.

This section exposes a write-capable tool that inserts rows into arbitrary Notion databases identified by supplied IDs. Although the text says 'Confirm with user,' that safeguard is only instructional and not an enforced control, so an agent or downstream workflow could perform unauthorized modifications if execution permissions are not strongly gated.

Natural-language row insertion is especially risky because freeform user or model-generated text can be translated into structured write actions without sufficiently precise validation. That increases the chance of prompt-influenced unintended writes, field manipulation, or insertion into the wrong database if the NL layer over-interprets instructions.

This update operation allows modification of existing Notion pages/rows via page_id and properties, which can alter or corrupt workspace data if invoked without robust authorization and target validation. The documentation does not describe technical controls preventing unauthorized updates beyond general usage guidance.

Database creation is a mutating administrative action that can materially change workspace structure, create persistence locations for data, or facilitate spam/exfiltration workflows if abused. The note to 'Confirm with user' is useful but insufficient as a security boundary because it is not an enforced access control.

Allowing content fetch by arbitrary page URL or block ID materially lowers the barrier to retrieving data if an agent is given or discovers a link, and the workflow does not require validation that the target belongs to the intended scope. In agent contexts, URL-based fetches are especially risky because prompt-injected or copied links can drive access to sensitive content without an explicit authorization check.

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).