Notion CLI – Command Line Interface based access to Notion for your agent
Security checks for vulnerabilities and agentic risk
Overview
This Notion CLI skill is coherent, but it should be reviewed because it installs mutable third-party code globally and enables token-backed commands that can modify or delete Notion content.
Before installing, verify and pin the upstream repository to a trusted commit or release, avoid global npm link when possible, run it in an isolated environment, and grant the Notion integration only the minimum pages and write permissions needed. Store the token in a protected secret mechanism rather than shell startup files, avoid passing it with --api-key, be careful with debug logging, and manually review create/update/archive/delete operations before running them on important workspace data.
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
T08 · Insecure Dependencies
Error
Location
SKILL.md:7
Finding
Unpinned Third-Party Repository and Unsafe Dependency Installation
Content
View full analysis
Vulnerability Details
File Location: SKILL.md, lines 7–12 Vulnerability Type: Supply-chain risk caused by installing and executing unpinned third-party code Risk Level: High
Complete Code Snippet:
sh
Install
Clone and install the CLI:
sh
git clone https://github.com/FroeMic/notion-cli
cd notion-cli
npm install
npm run build
npm link
Technical Analysis
The installation instructions clone the mutable default branch of an external GitHub repository without pinning a reviewed commit or release tag and without verifying its integrity. The project under audit contains no vendored source or lockfile through which the fetched implementation and its dependency graph can be independently reviewed.
Running npm install can execute dependency lifecycle scripts. The subsequent npm run build explicitly executes repository-controlled build logic, and npm link exposes the resulting command through the user's global npm environment. Consequently, the code ultimately executed can differ from the code that existed when this Skill was audited.
This is a supply-chain weakness rather than evidence that the named repository is currently malicious. Exploitation requires compromise or malicious modification of the upstream repository, its npm dependencies, or the resolved dependency graph.
Attack Path
An attacker compromises the referenced repository, a maintainer account, or a dependency resolved by npm install.
The attacker adds a malicious lifecycle script, build script, dependency, or CLI implementation to the mutable upstream source.
A user follows the Skill instructions and clones the current default branch.
npm install or npm run build executes the attacker-controlled code with the user's local privileges.
npm link may make the compromised CLI globally available to that user, allowing later invocations of the apparently legitimate notion command to ex
...[truncated 977 chars]
Remediation
View remediation
Remediation Suggestions
Pin the repository to a specific reviewed commit hash rather than cloning and building the mutable default branch:
sh
git clone https://github.com/FroeMic/notion-cli
cd notion-cli
git checkout --detach <reviewed-commit-sha>
Publish and verify signed release tags or release artifacts. Document the expected commit identifier and cryptographic checksum in the Skill.
Require a committed npm lockfile and use npm ci instead of npm install so dependency resolution is reproducible.
Audit package lifecycle and build scripts before execution. Where compatible with the package, initially install with scripts disabled:
sh
npm ci --ignore-scripts
Run only explicitly reviewed scripts afterward.
Avoid npm link unless global command exposure is necessary. Prefer a project-local installation or an isolated execution environment with minimal filesystem and network access.
Execute installation and the CLI as an unprivileged user. Do not use sudo or an administrator shell.
Grant the Notion integration access only to the minimum required pages and databases and only the required read/write capabilities.
Store NOTION_API_KEY in a protected secret store where possible. If a local environment file is used, restrict it to the owning user, exclude it from version control, and avoid passing the token through command-line arguments that may be exposed in process listings or shell history.
The documentation recommends persisting a long-lived Notion API secret in ~/.claude/.env or shell startup files, which can broaden exposure across sessions, tools, and local processes. In an agent environment, storing reusable credentials in persistent config increases the risk of accidental disclosure, unintended reuse by other skills, or compromise if local files are exposed.
Content
Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.
npm link
text
Set `NOTION_API_KEY` environment variable:
1. Create an integration at https://www.notion.so/profile/integrations
2. Copy the Internal Integration Secret (starts with `ntn_` or `secret_`)
3. Share any pages/databases you want to access with the integration
- Recommended: Add to `~/.claude/.env` for Claude Code
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding
The skill documents destructive operations such as archiving, restoring, deleting blocks, and updating workspace content without any safety guidance, confirmation requirements, or warnings about irreversible or organization-wide effects. In an agent skill context, this increases the chance of accidental destructive actions against a live Notion workspace, especially when an API key with write access is already configured.
Content
No source excerpt is available for this finding.
External Transmission
Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content
Scanner excerpt · SKILL.md (reported line 97)May include surrounding context.
md
| Comments | Discussion threads on pages/blocks | Feedback, review notes |
API Reference
- Base URL: `https://api.notion.com/v1`
- API Version: `2022-06-28`
- Auth: `Authorization: Bearer $NOTION_API_KEY`
- Rate Limits: Automatic retry with exponential backoff (up to 3 retries)
External Transmission
Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content
Scanner excerpt · SKILL.md (reported line 105)May include surrounding context.
md
| Comments | Discussion threads on pages/blocks | Feedback, review notes |
API Reference
- Base URL: `https://api.notion.com/v1`
- API Version: `2022-06-28`
- Auth: `Authorization: Bearer $NOTION_API_KEY`
- Rate Limits: Automatic retry with exponential backoff (up to 3 retries)
External Transmission
Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content
Scanner excerpt · SKILL.md (reported line 114)May include surrounding context.
md
| Comments | Discussion threads on pages/blocks | Feedback, review notes |
API Reference
- Base URL: `https://api.notion.com/v1`
- API Version: `2022-06-28`
- Auth: `Authorization: Bearer $NOTION_API_KEY`
- Rate Limits: Automatic retry with exponential backoff (up to 3 retries)
External Transmission
Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content
Scanner excerpt · SKILL.md (reported line 123)May include surrounding context.
md
| Comments | Discussion threads on pages/blocks | Feedback, review notes |
API Reference
- Base URL: `https://api.notion.com/v1`
- API Version: `2022-06-28`
- Auth: `Authorization: Bearer $NOTION_API_KEY`
- Rate Limits: Automatic retry with exponential backoff (up to 3 retries)
External Transmission
Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content
Scanner excerpt · SKILL.md (reported line 132)May include surrounding context.
md
| Comments | Discussion threads on pages/blocks | Feedback, review notes |
API Reference
- Base URL: `https://api.notion.com/v1`
- API Version: `2022-06-28`
- Auth: `Authorization: Bearer $NOTION_API_KEY`
- Rate Limits: Automatic retry with exponential backoff (up to 3 retries)
External Transmission
Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content
Scanner excerpt · SKILL.md (reported line 105)May include surrounding context.
