Security audit

Notion Sync Obsidian

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to do Notion-to-Obsidian syncing as advertised, but its installation and credential-handling guidance expose users to avoidable high-impact risk.

Review this carefully before installing. Avoid the curl-to-bash installer unless you separately trust and verify it, store the Notion token outside shared or backed-up directories, do not run scripts in logged/recorded environments until token-prefix printing is removed, test with a disposable Obsidian vault first, and grant the Notion integration access only to the pages/databases you actually want synced.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

Location: INSTALL.md:6
Finding: Unverified Remote Script Is Downloaded and Executed
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/stop_timer.sh:22
Finding: Unvalidated PID File Can Terminate an Unrelated Process
Content: View full analysis
/dev/null 2>&1; then echo "🔍 Found running process: PID $PID" # Stop process echo "⏹️ Stopping process..." kill "$PID" # Wait for process to stop sleep 2 # Check whether it stopped if ps -p "$PID" > /dev/null 2>&1; then echo "⚠️ Process is still running; forcing termination..." kill -9 "$PID" ``` ### Technical Analysis The stop script treats the contents of `sync_timer.pid` as authoritative. It only checks whether a process with that numeric identifier currently exists. It does not verify: - That the PID value is valid numeric input. - That the process is owned by the expected user. - That the process command is `timer_checker.sh`. - That the process is the same instance originally launched by `start_timer.sh`. - That the PID file is securely owned and stored in a private directory. PIDs are reused by operating systems. Therefore, even an ordinary stale PID file can eventually identify an unrelated process. A user or process able to modify the Skill directory can also deliberately replace the PID value. The script first sends `SIGTERM` and then escalates to `SIGKILL` if the targeted process remains alive. ### Attack Path 1. The timer exits without removing `sync_timer.pid`, or a local attacker modifies the PID file. 2. The PID in that file belongs to an unrelated process owned by the user. 3. The user invokes `scripts/stop_timer.sh`. 4. The script confirms only that some process with that PID exists. 5. It sends `SIGTERM` to the unrelated process. 6. If that process remains alive after two seconds, the script sends `SIGKILL`. 7. The unrelated process is forcibly terminated and may lose unsaved data or interrupt ...[truncated 530 chars]
Remediation: View remediation
/cmdline`, `ps` command arguments, or a platform-appropriate equivalent. - Confirm that the target is the expected `timer_checker.sh` instance launched from this Skill directory. - Store runtime state in a private directory created with permissions such as `0700`. - Create the PID file with restrictive permissions and safe, atomic file-creation semantics. - Prefer process supervision through a platform service manager where appropriate. - Avoid automatic `SIGKILL`; report failure and require explicit user confirmation before forcibly terminating a process. - Remove the PID file when the timer exits by installing shell signal and exit traps. ]]>

T09 · Insecure Skill Coding Practices

Note

Location: config.json:1
Finding: Notion Token Is Stored in Plaintext and Partially Disclosed
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: INSTALL.md:168
Finding: Python Dependencies Are Installed Without Version or Integrity Pinning
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (49)

External Script Fetching

High

Category: Supply Chain
Confidence: 97% confidence
Finding: The installation instructions fetch and immediately execute a remote script from clawhub.com, creating a direct arbitrary code execution path. If the remote script or hosting infrastructure is compromised, users who follow the recommended install path will run attacker-controlled code on their systems.
Content: Scanner excerpt · INSTALL.md (reported line 8)May include surrounding context.
方法 1: 从 ClawHub 安装（推荐）

bash
# 安装 ClawHub CLI（如果尚未安装） curl -fsSL https://clawhub.com/install.sh | bash # 搜索技能 clawhub search notion-sync

Chaining Abuse

High

Category: Tool Misuse
Confidence: 98% confidence
Finding: Piping network output directly into bash removes the user's opportunity to review the fetched content and magnifies the danger of script substitution or transient compromise. This pattern is especially risky in installation documentation because it normalizes unsafe command chaining for all users of the skill.
Content: Scanner excerpt · INSTALL.md (reported line 8)May include surrounding context.
方法 1: 从 ClawHub 安装（推荐）

bash
# 安装 ClawHub CLI（如果尚未安装） curl -fsSL https://clawhub.com/install.sh | bash # 搜索技能 clawhub search notion-sync

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: If the actual behavior includes API account probing and creation of test files rather than article synchronization, the skill is performing actions outside its stated purpose. Unexpected probing and filesystem changes are security-relevant because they can reveal account metadata, create persistence artifacts, or normalize unsafe trust in undocumented behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: If the actual behavior includes API account probing and creation of test files rather than article synchronization, the skill is performing actions outside its stated purpose. Unexpected probing and filesystem changes are security-relevant because they can reveal account metadata, create persistence artifacts, or normalize unsafe trust in undocumented behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: If the actual behavior includes API account probing and creation of test files rather than article synchronization, the skill is performing actions outside its stated purpose. Unexpected probing and filesystem changes are security-relevant because they can reveal account metadata, create persistence artifacts, or normalize unsafe trust in undocumented behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: If the actual behavior includes API account probing and creation of test files rather than article synchronization, the skill is performing actions outside its stated purpose. Unexpected probing and filesystem changes are security-relevant because they can reveal account metadata, create persistence artifacts, or normalize unsafe trust in undocumented behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The natural-language content forces a specific language for all installation and operating instructions. Under the stated policy, a skill should not impose a language or locale without user opt-in or a clearly documented justification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The guide explicitly recommends a curl ... | bash installer without any warning, pinning, checksum verification, or instruction to inspect the script first. This trains users to execute unaudited remote code directly in their shell, which could lead to arbitrary code execution if the remote host, CDN, or delivery path is compromised.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · INSTALL.md (reported line 184)May include surrounding context.
ls -la /path/to/your/obsidian

修改权限（如果需要）

chmod 755 /path/to/your/obsidian

text
## 📊 监控和维护

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The README promotes automatic syncing and full local export into an Obsidian directory but does not clearly warn users that the skill will create and potentially overwrite large numbers of local markdown files. In a note-taking context, this can cause unintended data loss, vault clutter, or syncing propagation across the user's broader Obsidian/cloud workflow if users assume the operation is read-only or low-impact.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill advertises and instructs use of network access, shell scripts, and local file writes, yet the manifest does not declare any tool scope such as permissions or allowed-tools. This creates a transparency and containment failure: users and the hosting agent cannot accurately constrain what the skill may do, increasing the risk of unintended file modification or outbound API use with sensitive tokens.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The documentation asks users to export remote Notion content into a local Obsidian vault and to provide an API key, but it does not clearly warn about continuous local writes, retention of synced content, or privacy implications. In a note-taking context this is especially relevant because vaults often contain sensitive personal or business information, so quiet background syncing can expand exposure without informed consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The guide explicitly shows placing a live Notion API token in a plain-text config.json file and does not warn about secure storage, file permissions, or excluding the file from version control. This increases the risk of credential leakage through backups, screenshots, logs, repository commits, or local compromise, which could allow unauthorized access to synced Notion content.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The testing and manual sync commands can trigger network access to Notion and write exported content into the user's Obsidian vault, but the guide does not clearly warn about those side effects. This can lead to unintended data import, overwriting expectations, or privacy surprises when users run commands believing they are harmless diagnostics.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file's docstrings and all user-facing messages are written in Chinese, which effectively constrains the interaction language. There is no indication that the tool is intentionally region-specific or that users can opt into another language, so this appears to violate the language/locale choice policy.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/debug_page_structure.py (reported line 59)May include surrounding context.
python
print("=" * 60) try: response = requests.post( "https://api.notion.com/v1/search", headers=HEADERS, json={

External Transmission

Medium

Category: Data Exfiltration
Confidence: 80% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/debug_page_structure.py (reported line 59)May include surrounding context.
python
print("=" * 60) try: response = requests.post( "https://api.notion.com/v1/search", headers=HEADERS, json={

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This code performs authenticated HTTP requests to the Notion API and then displays returned page metadata and text snippets. While it logs that an API key is being used, it does not warn the user that page titles, URLs, properties, and block text will be fetched from Notion and echoed to stdout, which can expose sensitive workspace content during debugging.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script prints the first 10 characters of the Notion API key to stdout, unnecessarily disclosing credential material during a routine listing operation. Even partial secrets can be captured in terminal history, CI logs, screenshots, or support transcripts and may aid correlation or partial-secret recovery.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This output exposes part of the Notion API key without warning the user that credential material will be shown in the terminal. In shared shells, logs, or recorded sessions, this can leak sensitive authentication data beyond the intended operator.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · INSTALL.md (reported line 158)May include surrounding context.
md
# 搜索最近的文章 echo "🔍 搜索最近编辑的文章..." RESPONSE=$(curl -s -X POST "https://api.notion.com/v1/search" \ -H "Authorization: Bearer $API_KEY" \ -H "Notion-Version: 2022-06-28" \ -H "Content-Type: application/json" \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/debug_page_structure.py (reported line 60)May include surrounding context.
python
# 搜索最近的文章 echo "🔍 搜索最近编辑的文章..." RESPONSE=$(curl -s -X POST "https://api.notion.com/v1/search" \ -H "Authorization: Bearer $API_KEY" \ -H "Notion-Version: 2022-06-28" \ -H "Content-Type: application/json" \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/debug_page_structure.py (reported line 131)May include surrounding context.
python
# 搜索最近的文章 echo "🔍 搜索最近编辑的文章..." RESPONSE=$(curl -s -X POST "https://api.notion.com/v1/search" \ -H "Authorization: Bearer $API_KEY" \ -H "Notion-Version: 2022-06-28" \ -H "Content-Type: application/json" \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/list_recent_articles.sh (reported line 36)May include surrounding context.
sh
# 搜索最近的文章 echo "🔍 搜索最近编辑的文章..." RESPONSE=$(curl -s -X POST "https://api.notion.com/v1/search" \ -H "Authorization: Bearer $API_KEY" \ -H "Notion-Version: 2022-06-28" \ -H "Content-Type: application/json" \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/real_notion_checker.py (reported line 77)May include surrounding context.
python
# 搜索最近的文章 echo "🔍 搜索最近编辑的文章..." RESPONSE=$(curl -s -X POST "https://api.notion.com/v1/search" \ -H "Authorization: Bearer $API_KEY" \ -H "Notion-Version: 2022-06-28" \ -H "Content-Type: application/json" \

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T03 · Remote Payload Retrieval and Execution

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T08 · Insecure Dependencies

SkillSpector

External Script Fetching

方法 1: 从 ClawHub 安装（推荐）

Chaining Abuse

方法 1: 从 ClawHub 安装（推荐）

Tp4

Tp4

Tp4

Tp4

Natural-Language Policy Violations

Missing User Warnings

Sudo/Root Execution

修改权限（如果需要）

Missing User Warnings

Undeclared Tool Scope

Missing User Warnings

Missing User Warnings

Missing User Warnings

Natural-Language Policy Violations

External Transmission

External Transmission

Missing User Warnings

Context-Inappropriate Capability

Missing User Warnings

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

Static analysis