ClawHub
Back to skill

Security audit

Notion Personal Space Audit

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Notion personal-workspace audit workflow that reads workspace structure and only allows limited writes after explicit user authorization.

Install this only if you are comfortable giving an agent read access to the Notion pages/databases you ask it to audit. Treat any structure creation or guide-page update as a separate action: confirm the target parent/page and expected changes before authorizing writes, and do not provide broader Notion access than needed.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

md
7. **[LLM]** Recommend a small functional top-level architecture. Include an inbox, current actions, sensitive-analysis area, cognition/inputs, memory/archive, life tools, and archive only when evidence supports each area.
8. **[LLM]** Map every major existing database or page to a proposed destination. For ambiguous content, state the rule explicitly: sensitive analysis reports belong in a separate high-sensitivity archive; short event logs retain event records; raw conversations remain source material and link to derived decisions.
9. **[LLM]** Recommend minimal shared fields: content type, domain, status, occurrence date, organization date, sensitivity, and relations. Do not force one schema onto all content types.
10. **[LLM]** Produce a concise Markdown report with evidence, signal-light findings, proposed tree, migration table, phased migration order, and a clear statement that no Notion content was changed.
11. **[LLM]** If the user explicitly authorizes structure creation, create only empty navigation pages and usage instructions after the audit. Never move, delete, rename, or rewrite existing content unless separately authorized.
12. **[LLM]** If the user explicitly authorizes updating an existing audit/guide page, append a clearly marked usage-notes section rather than replacing prior findings; make the write idempotent with a unique marker and read the page back to verify the marker and section headings.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

md
1. Read-only by default: no Notion write endpoint is called unless the user explicitly authorizes structure creation or updating an existing guide page; authorized guide-page updates must append rather than replace.
2. Never move, delete, rename, or rewrite existing content as part of an audit or structure setup.
3. Never expose access tokens in reports, logs, or user-facing output.
4. Do not invent content the API did not return; mark inaccessible or uncertain areas explicitly.
5. Sensitive analysis reports are never classified as ordinary log events, and never merged into general archives.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

md
1. Read-only by default: no Notion write endpoint is called unless the user explicitly authorizes structure creation or updating an existing guide page; authorized guide-page updates must append rather than replace.
2. Never move, delete, rename, or rewrite existing content as part of an audit or structure setup.
3. Never expose access tokens in reports, logs, or user-facing output.
4. Do not invent content the API did not return; mark inaccessible or uncertain areas explicitly.
5. Sensitive analysis reports are never classified as ordinary log events, and never merged into general archives.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The listed Chinese trigger phrases include terms like 'Notion 空间整理' and '信息架构重构', which are broad and could match ordinary cleanup or organization requests rather than this specific read-only audit skill. The description does not provide negative examples or tighter scope constraints for when these phrases should or should not activate the skill.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The 'When to use' description says to use the skill whenever the user asks to audit a Notion personal workspace or page, inspect secondary pages or inline databases, explain usability problems, or design a safer information architecture. This is a broad natural-language trigger surface without explicit constraints or negative examples, which could overlap with ordinary Notion help requests and cause unintended invocation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

Line L034 states that only steps 2–4 are deterministic Notion API calls and that steps 1 and 5–12 are LLM analysis/synthesis. However, steps 11–12 explicitly describe creating pages, appending guide content, and reading back written content for verification, which are operational write/read API behaviors rather than merely LLM synthesis. This is an active contradiction in the procedure documentation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.