ClawHub
Back to skill

Security audit

notion-enhanced-markdown-integration

Security checks across malware telemetry and agentic risk

Overview

This is an instruction-only Notion integration that can read and edit shared Notion content, with no hidden code or deceptive behavior found.

Install this only if you want the agent to access Notion pages and databases shared with the integration. Use a dedicated least-privileged Notion integration, share only the needed pages, protect or avoid the plaintext API-key file, and review any operation that updates, replaces, or fetches sensitive page or transcript content.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The skill documents a full-content replacement operation for page markdown that can overwrite existing page contents, but it does not prominently warn that this action is destructive or recommend confirmation/backup steps before use. In an agent context, this increases the chance of accidental data loss or unintended modification of user content, especially when operating on the wrong page_id or ambiguous instructions.

Missing User Warnings

Medium
Confidence
82% confidence
Finding
The skill highlights reading page markdown and optionally including meeting transcripts, but it does not warn that these endpoints may expose highly sensitive notes, transcripts, or internal content to the agent and downstream systems. In practice, this can lead to over-collection or unintended disclosure of confidential information if users or agents fetch more content than necessary.

Session Persistence

Medium
Category
Rogue Agent
Content
## Setup

1. Create an integration at https://notion.so/my-integrations
2. Copy the API key (starts with `ntn_` or `secret_`)
3. Store it:
Confidence
86% confidence
Finding
Create an integration at https://notion.so/my-integrations 2. Copy the API key (starts with `ntn_` or `secret_`) 3. Store it: ```bash mkdir -p ~/.config/notion echo "ntn_your_key_here" > ~/.config/no

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.