T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:14- Finding
Notion API Token Stored Without Restrictive File Permissions
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 14–19
Vulnerability Type: Plaintext credential storage with potentially permissive filesystem permissions
Risk Level: Mediumbash 1. Create an integration at https://notion.so/my-integrations 2. Copy the API key (starts with `ntn_` or `secret_`) 3. Store it: ```bash mkdir -p ~/.config/notion echo "ntn_your_key_here" > ~/.config/notion/api_keytext ### Technical Analysis The setup instructions place a Notion bearer token in a plaintext file without explicitly restricting permissions on either the configuration directory or the token file. Their effective permissions therefore depend on the user's current `umask` and any preexisting directory permissions. On a multi-user system with an insufficiently restrictive configuration, another local account or compromised process may be able to read the token. A Notion API token is a reusable bearer credential: possession is sufficient to authenticate as the integration without an additional password or challenge. The issue does not expose a real hardcoded credential in the project—the displayed token is a placeholder—but following the documented command with a real token can create insecure credential storage. ### Attack Path 1. A user follows the documented setup procedure and replaces the placeholder with a valid Notion integration token. 2. The shell creates `~/.config/notion/api_key` using permissions derived from the user's `umask`; the instructions do not enforce owner-only access. 3. Another local user or a process operating under a different security context reads the file where filesystem permissions permit it. 4. The attacker copies the bearer token. 5. The attacker submits authenticated requests to `https://api.notion.com/v1/` using `Authorization: Bearer <stolen-token>`. 6. The attacker accesses or modifies resources shared with the compromised integration, subject to that int ...[truncated 599 chars]- Remediation
View remediation
Remediation Suggestions
Enforce owner-only permissions when creating both the directory and credential file:
bash install -d -m 700 "$HOME/.config/notion" ( umask 077 printf '%s\n' "ntn_your_key_here" > "$HOME/.config/notion/api_key" ) chmod 600 "$HOME/.config/notion/api_key"Additional hardening measures:
- Prefer an operating-system credential manager or dedicated secret-management service over a plaintext file.
- Do not place the token directly in shell command history. Read it silently from the terminal or provision it through a secure secret channel.
- Verify existing permissions with
statand reject use if the file is accessible by group or other users. - Keep the integration least-privileged and share only required Notion pages or data sources with it.
- Rotate the token immediately if unauthorized filesystem access is suspected.
- Ensure credential files are excluded from source control, backups with broad readership, logs, and diagnostic bundles.