Notion Agent

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:51 PM UTC
• Version: 1.0.1

Overview

This looks like a legitimate Notion integration, but its install instructions and data-changing Notion commands need careful review before use.

Install only if you are comfortable with a Notion agent that can change and archive shared Notion content. Avoid running the README's curl-to-shell installer blindly; install uv through a trusted package manager or inspect/verify the installer first. Use a dedicated low-privilege Notion integration token shared only with the specific pages and databases this skill should access, and require explicit confirmation before archive/delete or bulk update actions.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: README.md:18

Finding

Unverified Remote Installer Executed Through a Shell Pipeline

Content

View full analysis

Vulnerability Details

File Location: README.md, line 18
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code:

bash

curl -LsSf https://astral.sh/uv/install.sh | sh

Technical Analysis

The installation instructions download a mutable script from an external URL and pipe it directly into sh. The script is executed before the user can inspect it, and the command does not pin an artifact version or verify a checksum or cryptographic signature.

Although astral.sh is presented as the official source for the uv installer, relying on a trusted-looking HTTPS origin does not eliminate the underlying remote-code-execution risk. The payload may change after this Skill has been reviewed. Compromise of the hosting infrastructure, publication process, domain, or relevant TLS trust chain could therefore turn the documented installation command into arbitrary code execution.

This behavior exceeds the minimum privileges needed by the declared Notion integration. The Skill only needs a Python environment and its declared dependency; it does not inherently require executing an unverified remote shell program.

Attack Path

1. An attacker compromises the remote installer, its hosting or publication infrastructure, or another component in the delivery trust chain.
2. The attacker modifies the response served from https://astral.sh/uv/install.sh to include malicious shell commands.
3. A user follows the installation instructions in README.md.
4. curl downloads the current response and streams it directly to sh.
5. The shell executes the attacker-controlled commands without integrity validation or prior local inspection.
6. The payload operates with all permissions available to the invoking user.

Impact Assessment

Successful exploitation permits arbitrary command execution under the installing user's account. Depending on that account's permissions a ...[truncated 519 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the direct curl | sh installation instruction.
2. Prefer installation through a trusted operating-system package manager or another repository-managed distribution channel.
3. If a standalone installer is necessary:
   • Link to a specific, pinned release artifact rather than a mutable installer endpoint.
   • Download the artifact to disk as a separate step.
   • Verify its published cryptographic signature or pinned SHA-256 checksum.
   • Fail closed if verification does not succeed.
   • Allow the user to inspect the downloaded file before execution.
   • Execute it without elevated privileges unless elevation is demonstrably required.
4. Document the exact files and directories the installer is expected to modify.
5. Add a dependency lockfile for reproducible Python dependency resolution. The current requests>=2.31.0 lower-bound-only declaration allows future, unreviewed versions, although no malicious dependency was confirmed during this audit.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (13)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

Using | sh causes untrusted network content to be executed immediately in the user's shell, which is a classic command-chaining hazard. In the context of a developer-facing skill README, this increases the likelihood that users will run the command verbatim, potentially leading to arbitrary code execution on their machine if the upstream script is tampered with.

Content

Scanner excerpt · README.md (reported line 18)May include surrounding context.

1. Ensure uv is installed:

   bash

   curl -LsSf https://astral.sh/uv/install.sh | sh
   

2. Set your Notion integration token:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The markdown advertises 'Create, read, update, delete (archive) pages' as a feature, but it does not include any caution that these actions modify or can effectively remove user content. For a skill description, destructive or data-altering behavior should be disclosed so users understand the risk before invoking it.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill documents use of environment variables and outbound network access to the Notion API, but it does not declare any tool scope such as permissions or allowed-tools. In an agent setting, this weakens least-privilege controls and can let the skill operate with broader capabilities than users may expect, especially when handling workspace content and tokens.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill includes a page delete/archive command without any warning, confirmation guidance, or explanation of data impact. In an agent-driven workflow, this increases the risk of accidental destructive actions against user workspace content, particularly if an LLM misinterprets a request or acts on ambiguous instructions.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 183)May include surrounding context.

--content "Attendees: Team"

text

**Add task to project database:**
```bash
uv run {baseDir}/scripts/notion.py db add <project_db_id> \
  --props '{"Name":{"title":[{"text":{"content":"Fix bug #123"}}]},"Status":{"select":{"name":"In Progress"}},"Priority":{"select":{"name":"High"}}}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 162)May include surrounding context.

md

class NotionClient:
    """Low-level Notion API client."""
    
    BASE_URL = "https://api.notion.com/v1"
    API_VERSION = "2022-06-28"
    
    def __init__(self, token: Optional[str] = None):

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · lib/client.py (reported line 10)May include surrounding context.

python

class NotionClient:
    """Low-level Notion API client."""
    
    BASE_URL = "https://api.notion.com/v1"
    API_VERSION = "2022-06-28"
    
    def __init__(self, token: Optional[str] = None):

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The README instructs users to install software by piping a remotely fetched script directly into the shell. This bypasses review of the downloaded content and creates a supply-chain execution risk if the hosting endpoint, transport path, or install script is compromised.

Content

Scanner excerpt · README.md (reported line 18)May include surrounding context.

1. Ensure uv is installed:

   bash

   curl -LsSf https://astral.sh/uv/install.sh | sh
   

2. Set your Notion integration token:

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The setup instructions tell users to export a Notion integration token but provide no warning about treating it as a secret. In agent environments, credentials can be inadvertently logged, echoed, committed to shell history, or exposed to other tools, enabling unauthorized access to Notion data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This code performs outbound HTTP requests to the Notion API and includes a bearer token in the Authorization header, which transmits credentials and potentially user-provided data. The file contains no confirmation prompt, visible log/print statement, or warning to disclose this network transmission behavior to the user.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This code sends user-provided title/content and page identifiers to a remote Notion API via HTTP, but there is no user-facing warning, logging, or comment disclosing that data is transmitted off-process. The surrounding docstrings describe CRUD behavior but do not explicitly warn about remote transmission of user data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The delete method archives a page by making a remote PATCH request that changes persistent state, but the implementation provides no confirmation prompt or explicit user-facing warning beyond a brief docstring. For a state-changing operation affecting user data, some visible disclosure is expected unless clearly documented elsewhere.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 92% confidence

Finding

The dependency specification uses a broad lower bound (requests>=2.31.0) rather than pinning to a known-safe version, so installations may resolve to different releases depending on environment state. Because requests has multiple published advisories, leaving the version unconstrained makes it impossible to verify from this manifest alone whether a deployed environment is protected from known issues such as credential leakage or other library-specific flaws.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.