ClawHub
Back to skill

Security audit

Openclaw Notion Api

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Notion API helper, but it asks users to store a powerful Notion token in plaintext and provides read/write/upload commands without strong safety boundaries.

Review this before installing if the connected Notion workspace contains sensitive or business-critical data. Use a least-privilege Notion integration, share only the pages or databases needed, prefer an OS keychain or secret manager over the documented plaintext token file, and confirm page/database IDs and local file paths before running any create, update, append, or upload command.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:16
Finding

Notion API Key Stored Without Explicitly Restrictive File Permissions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 16–20
Vulnerability Type: Insecure plaintext credential storage
Risk Level: Medium

Vulnerable Code

bash
mkdir -p ~/.config/notion
echo "ntn_your_key_here" > ~/.config/notion/api_key

Technical Analysis

The setup instructions store a Notion integration token in a plaintext file but do not explicitly restrict permissions on either the containing directory or the credential file. The resulting access permissions depend on the user's current umask and any pre-existing permissions on ~/.config/notion.

On a shared or otherwise compromised system, an overly permissive configuration could allow another local account or process to read the token. The command also encourages direct insertion of the credential into a shell command, which may expose it through shell history.

Attack Path

  1. A user follows the documented setup procedure and writes a valid Notion integration token to ~/.config/notion/api_key.
  2. The user's umask, directory permissions, or pre-existing file permissions allow access by another local account or process.
  3. An attacker reads the plaintext token from the credential file.
  4. The attacker submits requests to https://api.notion.com using Authorization: Bearer <stolen-token>.
  5. The attacker accesses or modifies resources shared with the compromised Notion integration, subject to its configured capabilities.

Impact Assessment

Successful exploitation grants the attacker the same Notion API privileges as the compromised integration. The affected scope includes pages, databases, blocks, and files shared with that integration. Depending on the integration's capabilities, the attacker may read sensitive workspace content, create or modify records, append blocks, or upload files. This does not inherently grant access to Notion resources that were not shared with the integration.

Remediation
View remediation

Remediation Suggestions

Create the credential directory and file with explicit owner-only permissions:

bash
install -d -m 700 "$HOME/.config/notion"
umask 077
printf '%s\n' "$NOTION_KEY" > "$HOME/.config/notion/api_key"
chmod 600 "$HOME/.config/notion/api_key"

Do not place the actual token directly in an interactive shell command, because it may be retained in shell history. Prefer reading it silently or retrieving it from an operating-system credential manager:

bash
install -d -m 700 "$HOME/.config/notion"
IFS= read -r -s -p "Notion API key: " NOTION_KEY
printf '\n'
umask 077
printf '%s\n' "$NOTION_KEY" > "$HOME/.config/notion/api_key"
unset NOTION_KEY

Where practical, use a dedicated secret manager or OS keychain instead of a plaintext file. Configure the Notion integration with the minimum required capabilities and share only necessary pages or databases. Rotate the token immediately if unauthorized file access is suspected.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL_en.md:16
Finding

Notion API Key Stored Without Explicitly Restrictive File Permissions

Content
View full analysis

Vulnerability Details

File Location: SKILL_en.md, lines 16–20
Vulnerability Type: Insecure plaintext credential storage
Risk Level: Medium

Vulnerable Code

bash
mkdir -p ~/.config/notion
echo "ntn_your_key_here" > ~/.config/notion/api_key

Technical Analysis

The English setup instructions store a Notion integration token in a plaintext file without explicitly assigning owner-only permissions to the directory or file. Effective permissions therefore depend on the user's umask and any existing filesystem permissions.

If the resulting file is readable by another local account or an unintended process, the Notion token can be recovered and reused remotely. Entering a real credential directly in the illustrated shell command may also record it in shell history.

Attack Path

  1. A user follows the setup instructions and writes a valid token to ~/.config/notion/api_key.
  2. Local permissions unintentionally permit another account or process to read that file.
  3. An attacker extracts the plaintext token.
  4. The attacker authenticates to the Notion API with the stolen bearer token.
  5. The attacker performs authorized API operations against resources shared with the integration.

Impact Assessment

The attacker obtains the compromised integration's effective privileges, potentially including the ability to read or modify shared Notion pages, databases, blocks, and uploaded content. The exact scope is constrained by the integration's configured capabilities and the resources connected to it. Resources not shared with the integration are not inherently exposed.

Remediation
View remediation

Remediation Suggestions

Replace the existing setup commands with instructions that enforce owner-only access:

bash
install -d -m 700 "$HOME/.config/notion"
umask 077
printf '%s\n' "$NOTION_KEY" > "$HOME/.config/notion/api_key"
chmod 600 "$HOME/.config/notion/api_key"

Avoid embedding a genuine token directly in shell commands. Read it silently or use an operating-system credential manager:

bash
install -d -m 700 "$HOME/.config/notion"
IFS= read -r -s -p "Notion API key: " NOTION_KEY
printf '\n'
umask 077
printf '%s\n' "$NOTION_KEY" > "$HOME/.config/notion/api_key"
unset NOTION_KEY

Apply least privilege to the Notion integration, connect it only to required resources, and rotate any token that may have been exposed.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (34)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill instructs users to authenticate to Notion and perform read, create, update, query, and file upload operations against a third-party SaaS, but it does not clearly warn that workspace content and uploaded files will be transmitted externally and that remote data may be modified. This creates a real safety and privacy transparency issue because users may execute examples without understanding the data exposure and write-side effects.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
97% confidence
Finding

This duplicate finding points to the same behavior: persistent storage of the Notion bearer token in a predictable plaintext location. Although common in quickstart docs, it is still unsafe because compromise of the host or home-directory backups would expose a credential capable of reading or modifying remote workspace data.

Content

Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.

  1. 复制 API 密钥（以 ntn_ 或 secret_ 开头）
  2. 存储密钥：
bash
mkdir -p ~/.config/notion
echo "ntn_your_key_here" > ~/.config/notion/api_key
  1. 将目标页面/数据库与集成共享（点击 "..." → "Connect to" → 你的集成名称）

Session Persistence

Medium
Category
Rogue Agent
Confidence
97% confidence
Finding

This duplicate finding points to the same behavior: persistent storage of the Notion bearer token in a predictable plaintext location. Although common in quickstart docs, it is still unsafe because compromise of the host or home-directory backups would expose a credential capable of reading or modifying remote workspace data.

Content

Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.

  1. 复制 API 密钥(以 ntn_ 或 secret_ 开头)
  2. 存储密钥:
bash
mkdir -p ~/.config/notion
echo "ntn_your_key_here" > ~/.config/notion/api_key
  1. 将目标页面/数据库与集成共享(点击 "..." → "Connect to" → 你的集成名称)

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

The direct reference to api.notion.com indicates that the skill sends information to an external cloud service. This is not inherently malicious in a Notion API skill, but it is still security-relevant because users may expose workspace data or tokens to a third-party endpoint without sufficient disclosure in the documentation.

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

所有请求都需要：

bash
NOTION_KEY=$(cat ~/.config/notion/api_key)
curl -X GET "https://api.notion.com/v1/..." \
  -H "Authorization: Bearer $NOTION_KEY" \
  -H "Notion-Version: 2025-09-03" \
  -H "Content-Type: application/json"

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

The direct reference to api.notion.com indicates that the skill sends information to an external cloud service. This is not inherently malicious in a Notion API skill, but it is still security-relevant because users may expose workspace data or tokens to a third-party endpoint without sufficient disclosure in the documentation.

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

所有请求都需要：

bash
NOTION_KEY=$(cat ~/.config/notion/api_key)
curl -X GET "https://api.notion.com/v1/..." \
  -H "Authorization: Bearer $NOTION_KEY" \
  -H "Notion-Version: 2025-09-03" \
  -H "Content-Type: application/json"

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

The search example transmits user queries and authenticated context to Notion, potentially revealing workspace structure or sensitive search terms. Because the skill is designed for Notion operations this is contextually expected, but it remains a real external transmission concern that should be clearly disclosed.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

搜索页面和数据源：

bash
curl -X POST "https://api.notion.com/v1/search" \
  -H "Authorization: Bearer $NOTION_KEY" \
  -H "Notion-Version: 2025-09-03" \
  -H "Content-Type: application/json" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

Fetching a page sends an authenticated request to an external SaaS and may retrieve potentially sensitive remote content. The risk is not that the endpoint is suspicious, but that users are encouraged to access external workspace data without an explicit privacy and data-handling warning.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

获取页面：

bash
curl "https://api.notion.com/v1/pages/{page_id}" \
  -H "Authorization: Bearer $NOTION_KEY" \
  -H "Notion-Version: 2025-09-03"

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

Retrieving block children transmits an authenticated request and can return the substantive contents of a page from Notion. In this skill's context that is intended functionality, but it is still a genuine confidentiality concern because content leaves the local environment and may be displayed or logged.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

获取页面内容（块）：

bash
curl "https://api.notion.com/v1/blocks/{page_id}/children" \
  -H "Authorization: Bearer $NOTION_KEY" \
  -H "Notion-Version: 2025-09-03"

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

This example performs a remote create operation in Notion, meaning the skill is not merely reading data but also changing external workspace state. Without a prominent warning, users may unintentionally create records in production databases or shared workspaces.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

在数据源中创建页面：

bash
curl -X POST "https://api.notion.com/v1/pages" \
  -H "Authorization: Bearer $NOTION_KEY" \
  -H "Notion-Version: 2025-09-03" \
  -H "Content-Type: application/json" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

Querying a data source sends filters, sort logic, and authenticated access to Notion, which may disclose operational metadata and retrieve sensitive records. The action is normal for a Notion skill, but it crosses a trust boundary and should be disclosed as such.

Content

Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.

查询数据源（数据库）：

bash
curl -X POST "https://api.notion.com/v1/data_sources/{data_source_id}/query" \
  -H "Authorization: Bearer $NOTION_KEY" \
  -H "Notion-Version: 2025-09-03" \
  -H "Content-Type: application/json" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

Creating a data source remotely changes workspace structure and may affect shared operational content. In context this is legitimate API usage, but absent a clear warning it can cause unintended external modifications and governance issues in a shared Notion environment.

Content

Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.

创建数据源（数据库）：

bash
curl -X POST "https://api.notion.com/v1/data_sources" \
  -H "Authorization: Bearer $NOTION_KEY" \
  -H "Notion-Version: 2025-09-03" \
  -H "Content-Type: application/json" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

Updating page properties modifies remote Notion data and can alter workflow state, status fields, or business records. The skill context makes the operation expected, but the lack of strong caution means users may inadvertently change production data.

Content

Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.

更新页面属性：

bash
curl -X PATCH "https://api.notion.com/v1/pages/{page_id}" \
  -H "Authorization: Bearer $NOTION_KEY" \
  -H "Notion-Version: 2025-09-03" \
  -H "Content-Type: application/json" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

Appending blocks writes content into a remote Notion page, which can create unwanted records, notes, or artifacts in shared workspaces. This is intended functionality, but it is still security-relevant because it alters external data without an accompanying top-level warning about side effects.

Content

Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.

向页面添加块：

bash
curl -X PATCH "https://api.notion.com/v1/blocks/{page_id}/children" \
  -H "Authorization: Bearer $NOTION_KEY" \
  -H "Notion-Version: 2025-09-03" \
  -H "Content-Type: application/json" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

Creating a file upload object initiates an external transfer workflow with Notion and prepares for remote storage of user-provided files. This is a real data-exposure concern because users may not realize files and related metadata are being sent to a third-party cloud service.

Content

Scanner excerpt · SKILL.md (reported line 161)May include surrounding context.

创建上传对象以获取上传 URL：

bash
curl --request POST \
  --url 'https://api.notion.com/v1/file_uploads' \
  -H "Authorization: Bearer $NOTION_KEY" \
  -H 'Content-Type: application/json' \
  -H 'Notion-Version: 2025-09-03' \

External Transmission

Medium
Category
Data Exfiltration
Confidence
96% confidence
Finding

This command uploads actual file contents to Notion, making the external transmission risk concrete and potentially more sensitive than metadata-only requests. If used carelessly, confidential documents or images could be exposed to a third-party service and shared workspace members.

Content

Scanner excerpt · SKILL.md (reported line 177)May include surrounding context.

使用 multipart/form-data 上传实际的文件：

bash
curl --request POST \
  --url 'https://api.notion.com/v1/file_uploads/{file_upload_id}/send' \
  -H "Authorization: Bearer $NOTION_KEY" \
  -H 'Notion-Version: 2025-09-03' \
  -H 'Content-Type: multipart/form-data' \

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

Attaching an uploaded image to a page finalizes remote publication of the file within Notion content, increasing the chance of accidental disclosure through workspace sharing. In this skill, the action is expected, but the documentation should still treat it as a sensitive external write operation.

Content

Scanner excerpt · SKILL.md (reported line 197)May include surrounding context.

上传图片：

bash
curl --request PATCH \
  --url "https://api.notion.com/v1/blocks/{page_id}/children" \
  -H "Authorization: Bearer $NOTION_KEY" \
  -H 'Content-Type: application/json' \
  -H 'Notion-Version: 2025-09-03' \

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

Attaching an uploaded file to a page publishes remote content into Notion and can expose documents to collaborators or downstream exports. The capability is appropriate for the skill, but it is still a genuine security issue when not paired with clear disclosure and permission cautions.

Content

Scanner excerpt · SKILL.md (reported line 219)May include surrounding context.

上传文件：

bash
curl --request PATCH \
  --url "https://api.notion.com/v1/blocks/{page_id}/children" \
  -H "Authorization: Bearer $NOTION_KEY" \
  -H 'Content-Type: application/json' \
  -H 'Notion-Version: 2025-09-03' \

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill explicitly enables creating, updating, and uploading content to Notion, which can modify or overwrite remote user data, but it does not clearly warn users before presenting write-capable commands. In an agent setting, missing disclosure around destructive or state-changing operations increases the risk of unintended data modification.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
93% confidence
Finding

The skill instructs users to persist a long-lived Notion API key in plaintext at a predictable location under the home directory. Plaintext credential storage increases the risk of token theft by other local processes, accidental backup leakage, or inadvertent disclosure through logs and shell history.

Content

Scanner excerpt · SKILL_en.md (reported line 15)May include surrounding context.

Setup

  1. Create an integration at https://notion.so/my-integrations
  2. Copy the API key (starts with ntn_ or secret_)
  3. Store it:
bash

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL_en.md (reported line 29)May include surrounding context.

All requests need:

bash
NOTION_KEY=$(cat ~/.config/notion/api_key)
curl -X GET "https://api.notion.com/v1/..." \
  -H "Authorization: Bearer $NOTION_KEY" \
  -H "Notion-Version: 2025-09-03" \
  -H "Content-Type: application/json"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL_en.md (reported line 29)May include surrounding context.

All requests need:

bash
NOTION_KEY=$(cat ~/.config/notion/api_key)
curl -X GET "https://api.notion.com/v1/..." \
  -H "Authorization: Bearer $NOTION_KEY" \
  -H "Notion-Version: 2025-09-03" \
  -H "Content-Type: application/json"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL_en.md (reported line 41)May include surrounding context.

All requests need:

bash
NOTION_KEY=$(cat ~/.config/notion/api_key)
curl -X GET "https://api.notion.com/v1/..." \
  -H "Authorization: Bearer $NOTION_KEY" \
  -H "Notion-Version: 2025-09-03" \
  -H "Content-Type: application/json"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL_en.md (reported line 50)May include surrounding context.

All requests need:

bash
NOTION_KEY=$(cat ~/.config/notion/api_key)
curl -X GET "https://api.notion.com/v1/..." \
  -H "Authorization: Bearer $NOTION_KEY" \
  -H "Notion-Version: 2025-09-03" \
  -H "Content-Type: application/json"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL_en.md (reported line 57)May include surrounding context.

All requests need:

bash
NOTION_KEY=$(cat ~/.config/notion/api_key)
curl -X GET "https://api.notion.com/v1/..." \
  -H "Authorization: Bearer $NOTION_KEY" \
  -H "Notion-Version: 2025-09-03" \
  -H "Content-Type: application/json"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL_en.md (reported line 79)May include surrounding context.

All requests need:

bash
NOTION_KEY=$(cat ~/.config/notion/api_key)
curl -X GET "https://api.notion.com/v1/..." \
  -H "Authorization: Bearer $NOTION_KEY" \
  -H "Notion-Version: 2025-09-03" \
  -H "Content-Type: application/json"

Static analysis

No suspicious patterns detected.