Vibe Notionbot

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:16 PM UTC
• Version: 1.5.0

Overview

The skill is mostly coherent for managing Notion, but it grants broad workspace-changing power through an unpinned npm package and also points agents toward a broader private-API credential path.

Review before installing. Use a narrowly scoped Notion integration token, share only the pages and databases needed, pin the vibe-notion package to a reviewed version where possible, and review any archive/delete/database/batch command before it runs. Avoid the separate private-API desktop-token path unless you intentionally want that broader credential behavior.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:9

Finding

Unpinned Third-Party Package Installation and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:9-12
Vulnerability Type: Unpinned npm dependency
Risk Level: Medium

Vulnerable Code

yaml

install:
  - kind: node
    package: vibe-notion
    bins: [vibe-notionbot]

Related runtime installation instructions also appear at SKILL.md:379-385:

bash

npx -y -p vibe-notion vibe-notionbot ...
bunx -p vibe-notion vibe-notionbot ...
pnpm dlx --package vibe-notion vibe-notionbot ...

Technical Analysis

The installation metadata and package-runner commands identify vibe-notion without an exact version or integrity digest. Consequently, installation resolves the package version available from the registry at execution time rather than a version whose contents were reviewed with this Skill.

The npx -y instruction compounds this risk by automatically approving package installation. npm packages may execute installation lifecycle hooks and arbitrary code when their binaries start. Therefore, a compromised maintainer account, malicious future release, or package-resolution incident could cause behavior materially different from the audited documentation.

No evidence establishes that the current package is malicious. The confirmed weakness is the absence of dependency pinning and integrity controls.

Attack Path

1. An attacker compromises the package publisher, registry delivery path, or a future vibe-notion release.
2. A user or agent installs the package through the unversioned Skill installer or invokes one of the documented package-runner commands.
3. The package manager resolves and downloads the attacker-controlled release.
4. Package lifecycle code or the vibe-notionbot executable runs with the invoking user's local permissions.
5. Malicious code accesses resources available to that process, potentially including NOTION_TOKEN, local files, and Notion data accessible to the configured integration.

Impact Asse

...[truncated 637 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the package to an exact reviewed version in the Skill metadata, for example:

   yaml

   install:
     - kind: node
       package: vibe-notion@1.5.0
       bins: [vibe-notionbot]
   

2. Pin the same exact version in every fallback command:

   bash

   npx -p vibe-notion@1.5.0 vibe-notionbot ...
   bunx -p vibe-notion@1.5.0 vibe-notionbot ...
   pnpm dlx --package vibe-notion@1.5.0 vibe-notionbot ...
   

3. Avoid npx -y for first-time or unverified installations so that package retrieval is not silently approved.

4. Use a lockfile and registry integrity verification where the installation environment supports them.

5. Review package contents, dependency changes, lifecycle scripts, and published provenance before updating the pinned version.

6. Run the CLI with least privilege: use a narrowly scoped Notion integration, share only required workspace objects with it, and avoid exposing unrelated secrets in the process environment.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill recommends executing npx -y -p vibe-notion vibe-notionbot ... without pinning an exact package version. This allows whatever version is latest at execution time to be fetched and run, creating a supply-chain risk if a malicious or compromised release is published or if behavior changes unexpectedly.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.