Notion Integration

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:03 AM UTC
• Version: 1.0.0

Overview

The skill is a straightforward Notion API integration, but it warrants review because it can modify and archive workspace content while relying on a long-lived Notion token without strong safeguards.

Install only if you are comfortable giving the agent access to the Notion pages/databases you share with the integration. Use the narrowest Notion sharing scope possible, protect the token as a secret, and require a preview plus explicit confirmation before updates, comments, or archiving pages.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (14)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill broadly encourages searching, reading, creating, and syncing Notion workspace content to an external API endpoint without warning users about privacy, data classification, or consent boundaries. In enterprise settings, an agent could transmit sensitive internal documents, comments, or database records to a third-party service without the operator understanding the data-handling implications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill exposes a destructive 'archive/delete' operation but provides no requirement to confirm intent, preview the target, or warn the user before execution. In an agentic context, ambiguous page identification or prompt misunderstanding could cause unintended deletion or archival of important workspace content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The instructions tell users to place a long-lived Notion integration token in environment variables or gateway config without emphasizing that it is a sensitive secret requiring secure storage and redaction. This increases the risk of accidental exposure in shell history, logs, screenshots, checked-in config files, or agent output, which could grant unauthorized access to shared workspace content.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.

md

## 4. Detailed Steps — API Reference

**Base URL:** `https://api.notion.com/v1`  
**Auth:** `Authorization: Bearer {NOTION_TOKEN}`  
**Notion-Version:** `2022-06-28` (required in all request headers)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 96)May include surrounding context.

md

## 4. Detailed Steps — API Reference

**Base URL:** `https://api.notion.com/v1`  
**Auth:** `Authorization: Bearer {NOTION_TOKEN}`  
**Notion-Version:** `2022-06-28` (required in all request headers)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 159)May include surrounding context.

md

## 4. Detailed Steps — API Reference

**Base URL:** `https://api.notion.com/v1`  
**Auth:** `Authorization: Bearer {NOTION_TOKEN}`  
**Notion-Version:** `2022-06-28` (required in all request headers)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 174)May include surrounding context.

md

## 4. Detailed Steps — API Reference

**Base URL:** `https://api.notion.com/v1`  
**Auth:** `Authorization: Bearer {NOTION_TOKEN}`  
**Notion-Version:** `2022-06-28` (required in all request headers)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 227)May include surrounding context.

md

## 4. Detailed Steps — API Reference

**Base URL:** `https://api.notion.com/v1`  
**Auth:** `Authorization: Bearer {NOTION_TOKEN}`  
**Notion-Version:** `2022-06-28` (required in all request headers)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 301)May include surrounding context.

md

## 4. Detailed Steps — API Reference

**Base URL:** `https://api.notion.com/v1`  
**Auth:** `Authorization: Bearer {NOTION_TOKEN}`  
**Notion-Version:** `2022-06-28` (required in all request headers)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 403)May include surrounding context.

md

## 4. Detailed Steps — API Reference

**Base URL:** `https://api.notion.com/v1`  
**Auth:** `Authorization: Bearer {NOTION_TOKEN}`  
**Notion-Version:** `2022-06-28` (required in all request headers)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 449)May include surrounding context.

md

## 4. Detailed Steps — API Reference

**Base URL:** `https://api.notion.com/v1`  
**Auth:** `Authorization: Bearer {NOTION_TOKEN}`  
**Notion-Version:** `2022-06-28` (required in all request headers)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 577)May include surrounding context.

md

## 4. Detailed Steps — API Reference

**Base URL:** `https://api.notion.com/v1`  
**Auth:** `Authorization: Bearer {NOTION_TOKEN}`  
**Notion-Version:** `2022-06-28` (required in all request headers)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 615)May include surrounding context.

md

## 4. Detailed Steps — API Reference

**Base URL:** `https://api.notion.com/v1`  
**Auth:** `Authorization: Bearer {NOTION_TOKEN}`  
**Notion-Version:** `2022-06-28` (required in all request headers)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 829)May include surrounding context.

md

## 4. Detailed Steps — API Reference

**Base URL:** `https://api.notion.com/v1`  
**Auth:** `Authorization: Bearer {NOTION_TOKEN}`  
**Notion-Version:** `2022-06-28` (required in all request headers)

Static analysis

No suspicious patterns detected.