ClawHub
Back to skill

Security audit

Notion Workspace API Tools

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a normal Notion API helper, but its examples can change live Notion data and its token-file fallback should be handled carefully.

Install only if you are comfortable granting this skill access to the Notion workspace covered by your API token. Prefer environment variables or a secret manager over a plaintext token file; if using the fallback file, restrict permissions and do not sync or commit it. Test write/delete examples in a sandbox or on disposable pages first.

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The examples include state-changing and destructive Notion operations such as creating pages, updating properties, appending blocks, and moving pages to trash, but they do not warn users that these commands modify live workspace data. In a documentation context this can lead to accidental data loss or unintended changes when copied verbatim against production resources.

Session Persistence

Medium
Category
Rogue Agent
Content
If `NOTION_KEY` is not already available in a local shell workflow, keep a fallback token file:

```bash
mkdir -p ~/.config/notion
echo "ntn_your_key_here" > ~/.config/notion/api_key
```
Confidence
94% confidence
Finding
The documentation instructs users to persist a Notion API token in a plaintext file under the home directory as a fallback. Storing long-lived credentials on disk increases the chance of accidental disclosure through weak file permissions, backups, shell history-adjacent workflows, local compromise, or unintended inclusion in support bundles and dotfile syncing.

Static analysis

No suspicious patterns detected.