ClawHub
Back to skill

Security audit

Notion MCP

Security checks for vulnerabilities and agentic risk

Overview

This Notion skill is broad and powerful, but its Maton access, automation features, credential handling, and approval requirements are disclosed and mostly scoped to user-directed use.

Install only if you are comfortable using a Maton account and global CLI to access your Notion workspace. Before allowing writes, hosted functions, triggers, destinations, or event replay, verify the exact Notion connection, target resource, destination URL, data fields, and persistence behavior. Avoid local event watch --exec unless you provide and review the handler script yourself.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The file states that the extra Functions/Triggers sections 'add no Notion capability,' but they do provide actionable procedures for deploying code, invoking hosted functions, creating triggers, and configuring destinations. That framing can downplay risk and mislead an agent or reviewer into treating broad automation and egress features as harmless reference material, reducing scrutiny for higher-risk actions.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill materially expands from Notion CRUD/search into hosted functions, triggers, destinations, event replay, and automation management. Even though the text includes many safety warnings, it still equips an agent with actionable instructions for broader capabilities that can create persistent automations and data egress channels beyond the user’s likely expectation when invoking a 'Notion MCP' skill.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The documented maton trigger event watch --exec path enables local program execution on untrusted event payloads, which is a qualitatively different and more dangerous capability than interacting with Notion data. The documentation warns against unsafe usage, but including a ready-to-use execution primitive in this skill increases the chance an agent chains Notion/event content into local code execution or unattended event-driven actions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The description instructs callers that if a database has more than one data source, they cannot use a database_id parent and must identify a specific data_source_id first. However, the input schema still explicitly accepts a parent object with database_id, so the documented restriction is not enforced by the tool contract.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

In the top-level description, the tool instructs users to 'Provide a non-null value to update a property's value.' However, the properties field description explicitly says 'Use null to remove a property's value,' and the schema also permits null values. These two documentation statements describe conflicting behavior for the same input.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.