Notion Integration

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:15 AM UTC
• Version: 1.0.0

Overview

This is a straightforward Notion API helper that can read and change Notion data, with no evidence of hidden execution, persistence, or exfiltration.

Install this only if you are comfortable giving the skill access through a Notion integration token. Limit that token to the minimum pages and databases needed, avoid sharing or logging it, and test create/update actions on non-production content first. Consider pinning notion-client in your own environment before installation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:11

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 11–14
Vulnerability Type: Supply-chain risk from an unpinned dependency
Risk Level: Medium

Vulnerable Code

bash

# Install Notion client
pip install notion-client

Technical Analysis

The setup instructions install notion-client without pinning a reviewed version or verifying package integrity with cryptographic hashes. Consequently, the code installed by this command may change after the skill has been audited.

This does not establish that the current notion-client package is malicious. The risk arises because a future compromised, malicious, or incompatible release would be accepted automatically when a user follows the documented installation procedure. Package installation may execute build-related code, and the installed package is subsequently imported and executed by scripts/notion.py.

Attack Path

1. An attacker compromises the upstream package, a maintainer account, or the package distribution channel.
2. The attacker publishes a malicious release under the expected notion-client package name.
3. A user follows the skill's Quick Start instructions and runs pip install notion-client.
4. Pip resolves the uncontrolled latest release because no version or hash is specified.
5. Malicious code executes during installation or when scripts/notion.py imports and uses the package.

Impact Assessment

Malicious dependency code would run with the privileges of the user invoking pip or the script. It could access files, environment variables, and network resources available to that account. In this project, that scope may include the NOTION_TOKEN environment variable, potentially allowing access to Notion pages and databases shared with the associated integration. The precise impact would be limited by the local user's permissions and the Notion integration's configured access.

Remediation

View remediation

Remediation Suggestions

1. Pin notion-client to a specifically reviewed version rather than installing the latest release implicitly.

2. Maintain dependencies in a requirements or lock file containing cryptographic hashes.

3. Install with hash verification, for example:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

4. Configure pip to use an approved package index and disallow unexpected alternate sources.

5. Review and deliberately update the pinned version through a controlled dependency-update process.

6. Run the integration in a least-privileged virtual environment or container and grant the Notion integration access only to required pages and databases.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill advertises operational capabilities involving environment-based credentials but does not declare any explicit tool scope or permission boundary. This makes it harder to reason about what the skill is allowed to access and increases the chance that an agent invokes it with broader-than-necessary capabilities, especially where environment variables may contain sensitive tokens.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The trigger description is broad enough to match many ordinary Notion-related requests, including cases where users may only want advice rather than live workspace actions. Overbroad routing can cause the agent to activate a skill with write/delete capabilities in situations where a narrower, read-only or non-operational skill would be safer.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly includes create, update, and delete operations against Notion pages and databases without warning about destructive effects or requiring confirmation. In an agent setting, this raises the risk of unintended data loss or unauthorized modifications if the skill is triggered too loosely or used without sufficient user awareness.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/notion.py (reported line 26)May include surrounding context.

python

"""Query a Notion database."""
    try:
        from notion_client import Client
        notion = Client(auth=NOTION_TOKEN)
        results = notion.databases.query(database_id=database_id)
        return results
    except ImportError:

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/notion.py (reported line 42)May include surrounding context.

python

"""Query a Notion database."""
    try:
        from notion_client import Client
        notion = Client(auth=NOTION_TOKEN)
        results = notion.databases.query(database_id=database_id)
        return results
    except ImportError:

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/notion.py (reported line 62)May include surrounding context.

python

"""Query a Notion database."""
    try:
        from notion_client import Client
        notion = Client(auth=NOTION_TOKEN)
        results = notion.databases.query(database_id=database_id)
        return results
    except ImportError:

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/notion.py (reported line 77)May include surrounding context.

python

"""Query a Notion database."""
    try:
        from notion_client import Client
        notion = Client(auth=NOTION_TOKEN)
        results = notion.databases.query(database_id=database_id)
        return results
    except ImportError:

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The documentation instructs users to export a Notion API token but provides no guidance on secure secret handling, storage, or logging risks. This can lead to accidental credential exposure in shell history, shared terminals, screenshots, or debug output, which could allow unauthorized access to the connected Notion workspace.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The examples include create and update operations against live Notion pages and databases without any warning that they will modify remote user data. In an integration skill specifically designed to automate Notion workflows, this increases the chance of accidental destructive or unintended changes, especially if a user copies commands directly into a production workspace.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.