ClawHub
Back to skill

Security audit

Notion Workspace

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward Notion command-line skill whose read, write, archive, and search abilities are disclosed and align with its purpose.

Install only if you are comfortable giving this skill a Notion integration token. Scope the Notion integration to only the pages and databases needed, and treat create, update, append, and archive commands as real changes to your workspace.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill advertises broad Notion workspace automation and requires both environment access for the API key and network access to the Notion API, but it does not declare an explicit tool scope such as allowed-tools or permissions. That creates a trust and containment problem: an agent may be given capabilities broader than the user realizes, especially when the skill can read, modify, archive, and search workspace content using a high-privilege integration token.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill supports destructive or state-changing actions including db-create, db-update, page-create, page-update, page-archive, and blocks-append, but the description and usage section do not prominently warn users that these commands can alter or soft-delete Notion content across the workspace. In an agent setting, the absence of a clear warning increases the chance of unintended writes, archival actions, or mass changes being performed with a powerful integration token.

External Transmission

Medium
Category
Data Exfiltration
Content
import argparse
import requests

BASE = "https://api.notion.com/v1"
VERSION = "2022-06-28"
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The page_archive function archives a Notion page via a PATCH request, which changes user data state and may be difficult to reverse in practice. The code provides no confirmation prompt, warning message, or explanatory comment/docstring disclosing that this command performs an archival action.

Static analysis

No suspicious patterns detected.