notion-clipper-skill

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:49 PM UTC
• Version: 1.0.0

Overview

This skill appears to be a real Notion web clipper, but it needs review because it auto-installs/runs dependencies while using a Notion token and can copy private or internal pages into Notion.

Install only if you are comfortable granting the skill access to a Notion integration token, a persistent Chrome profile, arbitrary web pages you ask it to open, and write access to selected Notion pages/databases. Avoid clipping localhost, intranet, cloud metadata, admin, regulated, or sensitive logged-in pages; prefer a least-privileged Notion integration and a sandboxed browser/profile. Review or preinstall dependencies deterministically before first use instead of relying on the documented auto-install/npx path.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/main.ts:232

Finding

Unrestricted URL Navigation Enables Internal Resource Capture and Export

Content

View full analysis

{ const chrome = findChromeExecutable(); if (!chrome) throw new Error("Chrome executable not found. Install Chrome or set NOTION_CLIPPER_CHROME_PATH env."); const profileDir = resolveNotionClipperChromeProfileDir(); await mkdir(profileDir, { recursive: true }); const args = [ `--remote-debugging-port=${port}`, `--user-data-dir=${profileDir}`, "--no-first-run", "--no-default-browser-check", "--disable-popup-blocking", ]; if (headless) args.push("--headless=new"); args.push(url); return spawn(chrome, args, { stdio: "ignore" }); } ``` ```ts // scripts/main.ts:259-289 console.log(`Fetching: ${args.url}`); console.log(`Mode: ${args.wait ? "wait" : "auto"}`); // Capture the web page const result = await captureUrl(args); console.log(`Title: ${result.metadata.title}`); // Convert markdown to Notion blocks console.log("Converting to Notion blocks..."); const contentBlocks = convertMarkdownToNotionBlocks(result.markdown); // Build final blocks array const blocks: NotionBlock[] = []; // Add bookmark block at the top if enabled if (args.includeBookmark) { blocks.push(createBookmarkBlock(args.url)); blocks.push(createDividerBlock()); } // Add content blocks blocks.push(...contentBlocks); // Save to Notion if (targetDatabaseId) { console.log("Creating page in Notion database..."); const page = await createPageInDatabase(apiKey, { databaseId: targetDatabaseId, title: ...[truncated 2868 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:24

Finding

Automatic Dependency Installation and npx Execution Creates Supply-Chain Exposure

Content

View full analysis

) ``` ```bash # SKILL.md:39-41 (cd "${SKILL_DIR}/scripts" && (test -d node_modules || npm install) && unset http_proxy https_proxy all_proxy && npx -y tsx main.ts --database-name "Resources") ``` ```json // scripts/package.json:1-8 { "dependencies": { "@tryfabric/martian": "^1.2.4", "ws": "^8.18.0" }, "devDependencies": { "tsx": "^4.19.0" } } ``` ```json // scripts/package-lock.json:222-225 "node_modules/esbuild": { "version": "0.27.3", "dev": true, "hasInstallScript": true, ``` ### Technical Analysis The documented execution path automatically runs `npm install` whenever `node_modules` is absent and then invokes `npx -y tsx`. If `tsx` is not available locally, `npx -y` may retrieve and execute it without an interactive confirmation. The manifest uses mutable caret version ranges. Although a lockfile is present and records package versions, the reviewed lockfile did not show standard `resolved` and `integrity` metadata in the inspected entries. The dependency tree also includes `esbuild`, which declares an installation script. Lifecycle scripts execute with the permissions of the user running the Skill. No evidence was found that the currently named dependencies are intentionally malicious. The vulnerability is the execution model: future or altered dependency resolution, registry compromise, package-account takeover, lockfile replacement, or local package-resolution manipulation could cause unreviewed code to execute before the Skill handles sensitive data. ### Attac ...[truncated 1349 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence

Findings (35)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

This variant includes an undeclared capability with security relevance: reading a local API key from ~/.config/notion/api_key and enumerating databases. Hidden secret access and metadata enumeration are important behaviors that users may not expect from the brief description, reducing informed consent and increasing the chance of over-privileged execution.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

This variant includes an undeclared capability with security relevance: reading a local API key from ~/.config/notion/api_key and enumerating databases. Hidden secret access and metadata enumeration are important behaviors that users may not expect from the brief description, reducing informed consent and increasing the chance of over-privileged execution.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

This variant includes an undeclared capability with security relevance: reading a local API key from ~/.config/notion/api_key and enumerating databases. Hidden secret access and metadata enumeration are important behaviors that users may not expect from the brief description, reducing informed consent and increasing the chance of over-privileged execution.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High

• Category: Supply Chain
• Confidence: 80% confidence

Finding

form-data 4.0.5 is pulled in transitively by @notionhq/client typings/fetch stack, and the cited CRLF injection issue can be exploitable when attacker-controlled multipart field names or filenames are incorporated into generated requests. In a clipping skill that fetches arbitrary remote content and may handle untrusted metadata, this raises real supply-chain risk if multipart uploads or crafted fields are ever used by dependent code, though the lockfile alone does not prove active exploitability.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==8.19.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 87% confidence

Finding

ws 8.19.0 is a direct dependency and WebSocket libraries are exposed to network-originating input, so memory disclosure or memory exhaustion advisories are material. This skill explicitly uses Chrome CDP to fetch arbitrary URLs, which commonly relies on WebSocket communication; therefore malformed frames or fragmentation abuse could disrupt the agent process or potentially leak memory contents depending on how the dependency is used.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==8.19.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 80% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill instructs the agent to use network access, environment variables, and a locally stored API key, but it does not declare any explicit tool scope or allowed-tools restrictions. That increases the chance an agent executes the workflow with broader privileges than users expect, especially because it fetches arbitrary URLs and can write data into Notion.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

The skill instructs users to store a long-lived Notion API key in plaintext under ~/.config/notion/api_key. Plaintext session or API credential persistence increases the blast radius of local compromise, and this specific skill also auto-installs and executes dependencies, compounding exposure to token theft.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

Prerequisites

1. Notion API Key: Create an integration at https://notion.so/my-integrations
2. Store the key:

bash

mkdir -p ~/.config/notion

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The command uses npx -y tsx without pinning a specific package version, allowing execution of whatever version resolves at runtime. If the registry, dependency, or package is compromised, the skill can run attacker-controlled code before handling user data or credentials.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

This repeated use of npx -y tsx performs unpinned runtime package resolution. In a skill that also auto-installs dependencies and handles a Notion API key, that creates a realistic supply-chain execution path with access to secrets and network capabilities.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

An unpinned npx invocation can fetch and execute updated remote code at runtime, which is dangerous in a workflow that processes arbitrary web content and authenticates to Notion. Attackers could exploit package compromise or dependency confusion to execute code on the host.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The skill repeatedly recommends an unversioned npx -y tsx command, multiplying exposure to supply-chain compromise across normal usage paths. Because the same script may access browser sessions and a stored Notion token, compromise could lead to secret theft or unauthorized data writes.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

This is another unpinned runtime dependency execution point. The danger is amplified by the skill's design: it opens authenticated pages, captures rendered content, and sends results to a third-party API, so malicious package code would have useful access and cover.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

Executing tsx via unpinned npx leaves the skill vulnerable to package substitution or upstream compromise. In context, that could expose local files, environment variables, and Notion credentials while appearing to perform expected clipping behavior.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

This command path again relies on live, unpinned package execution from the registry. Because the skill is intended for frequent agent use, this creates a durable supply-chain risk rather than a one-off setup concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill encourages clipping pages in --wait mode for login-required or personalized content, but it does not clearly warn that authenticated private data may be captured and transmitted to Notion. In this context, the browser may render account-specific material, making accidental exfiltration of sensitive content a realistic risk.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The example command at this line repeats the same unpinned npx -y tsx pattern. Example snippets are often copied verbatim, so insecure examples materially increase exploitability by steering users toward non-deterministic code execution.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

This usage example encourages runtime retrieval of an unversioned package. In an agent skill, documentation doubles as execution policy, so insecure command examples function as an unsafe operational instruction.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

Another unpinned npx execution point creates an avoidable supply-chain risk. Since the skill may operate on login-required pages and persistent browser state, a compromised package could harvest sensitive rendered content or tokens.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The same pattern appears in additional examples, reinforcing unsafe behavior. Repetition across the document suggests users and agents will routinely execute non-reproducible remote code as part of normal clipping operations.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

This alias example wraps the same unpinned runtime invocation, potentially making insecure execution persistent in the user's shell configuration. That extends the attack surface beyond one command into future habitual use.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The troubleshooting guidance still directs users to execute npx -y tsx main.ts, preserving the same runtime supply-chain weakness even in recovery paths. Security guidance should not reintroduce unsafe execution patterns when users are already troubleshooting failures.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 194)May include surrounding context.

md

|--------|---------|-----------|
| `Invalid URL for link` | Notion API rejects non-http(s) URLs | Script now **removes all markdown links** by default to avoid validation errors. Content is preserved, only links are stripped. |

**Note**: The script automatically removes these invalid URL types:
- `javascript:`, `data:`, `file:`, `about:` protocols
- WeChat internal links (`weixin:`, `wx://`)
- Relative paths (`/path`, `./path`)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This code starts a local Chrome/Chromium process via spawn(...), which is a safety-relevant operation under the code-file warning criteria. In this file there is no confirmation prompt, visible logging, or explanatory comment/docstring disclosing that a browser process will be launched with a dedicated profile and remote debugging enabled.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/constants.ts (reported line 9)May include surrounding context.

ts

export const SCROLL_MAX_STEPS = 8;

export const NOTION_API_VERSION = "2022-06-28";
export const NOTION_API_BASE_URL = "https://api.notion.com/v1";

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/cdp.ts:196

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/cdp.ts:126