Voice2notion

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:44 AM UTC
• Version: 1.2.0

Overview

The skill matches its stated voice-to-Notion purpose, but it recommends public links for voice recordings and lacks clear privacy safeguards for sensitive audio and transcripts.

Review this before installing if you may process private, business, customer, medical, legal, or otherwise sensitive audio. Use a narrowly scoped Notion integration, avoid public recording links, prefer private or expiring access-controlled storage, and consider pinning faster-whisper in a dedicated virtual environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:9

Finding

Unpinned Third-Party Dependency Creates a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 9 and 57
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

Vulnerable Code

yaml

install:
  python: "uv pip install faster-whisper"

bash

# Install faster-whisper
uv pip install faster-whisper

Technical Analysis

The installation instructions retrieve faster-whisper without specifying an audited version, dependency lockfile, package hashes, or an explicitly trusted package index. Consequently, the installed package and its transitive dependencies can change without any corresponding modification to the reviewed skill.

Although the audit found no evidence that faster-whisper is currently malicious, this installation pattern provides insufficient protection against a compromised future release, compromised transitive dependency, package-index account takeover, or malicious package resolution from an untrusted configured index.

Python package installation may execute build-system code when a source distribution must be built. Package-controlled code is also executed when the installed library is imported and used.

Attack Path

1. An attacker compromises the specified package, one of its transitive dependencies, or a package source trusted by the user's package manager.
2. The attacker publishes a malicious release that satisfies the unrestricted installation request.
3. A user follows the documented uv pip install faster-whisper instruction.
4. The package manager resolves and installs the attacker-controlled release.
5. Malicious code executes during package building, package import, or transcription.
6. The payload acts with the privileges of the user running the installation or transcription process.

Impact Assessment

Successful exploitation could permit arbitrary code execution under the installing user's account. Depending on that account's access, the attacker could read local f ...[truncated 255 chars]

Remediation

View remediation

Remediation Suggestions

• Pin faster-whisper to a specifically reviewed version rather than installing the latest available release.
• Generate and distribute a dependency lockfile that pins all transitive dependencies.
• Require cryptographic hashes for downloaded packages, such as through a hash-verified requirements file.
• Explicitly configure an approved package index and disable unintended supplemental indexes.
• Prefer prebuilt, verified wheels where practical to reduce exposure to package build scripts.
• Document a controlled process for reviewing and updating dependency versions.
• Verify the provenance and integrity of automatically downloaded model artifacts.
• Install and run transcription inside a dedicated virtual environment with minimal filesystem and network permissions.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:128

Finding

Voice Recordings Are Recommended for Storage at Publicly Accessible URLs

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 128–138
Vulnerability Type: Public exposure of sensitive recordings
Risk Level: Medium

Vulnerable Documentation Excerpt

The instructions recommend uploading the recording to a publicly accessible URL and storing that URL in the recording-link property:

python

# Database property
"Recording link": {"url": "https://example.com/audio.m4a"}

The alternative cloud-storage procedure similarly directs the user to obtain a public sharing link.

Technical Analysis

Voice recordings may contain confidential conversations, personal data, credentials spoken aloud, business information, and identifying voice characteristics. A public or unrestricted sharing URL removes access control from the recording itself and expands exposure beyond the intended Notion integration.

Possession of such a URL may be sufficient to retrieve the recording. URLs can leak through Notion page sharing, browser history, synchronization services, application logs, HTTP referrers, messaging systems, screenshots, or accidental forwarding. The documented process does not require authentication, expiration, explicit consent, retention limits, or verification that the recording is suitable for public disclosure.

The issue is a confidentiality weakness in the prescribed workflow. The project contains documentation only, so the audit did not establish that recordings are automatically uploaded or exposed without a user following these instructions.

Attack Path

1. A user records a conversation containing private or sensitive information.
2. The user follows the documented workflow and uploads the recording with public-link access.
3. The public URL is saved in the Notion database.
4. The URL leaks through database sharing, logs, browser history, link forwarding, or another connected service.
5. An unauthorized party obtains the URL and downloads or redistributes the recordi ...[truncated 547 chars]

Remediation

View remediation

Remediation Suggestions

• Replace public sharing links with private object storage protected by authentication and authorization.
• Use short-lived signed URLs and issue them only when an authorized user requests access.
• Restrict storage and Notion integration permissions according to least privilege.
• Require explicit informed consent before uploading or sharing a recording.
• Warn users to review recordings for confidential or regulated information before external storage.
• Define retention periods and provide procedures for revoking links and permanently deleting recordings.
• Encrypt recordings in transit and at rest.
• Avoid writing full signed URLs to persistent logs because query parameters may contain access credentials.
• If external hosting is unavoidable, document provider-specific settings that prevent public discovery and unauthenticated access.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill documents how to upload transcriptions and audio links into Notion, including use of publicly accessible URLs for recordings, but it does not clearly warn users that sensitive spoken content and related metadata will be sent to a third-party service and may become broadly accessible if public links are used. This creates a real privacy and data exposure risk, especially for meeting notes, personal recordings, or confidential business discussions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.