ClawHub
Back to skill

Security audit

Notion MCP

Security checks for vulnerabilities and agentic risk

Overview

The skill is purpose-aligned for Notion MCP access, but its OAuth flow asks users to paste sensitive callback URLs into chat and command arguments while requesting read/write workspace access.

Install only if you are comfortable granting Notion workspace read/write access through UXC. Prefer a direct interactive OAuth flow when available, avoid pasting callback URLs into persistent chat or logs, and request write scope only for tasks that actually need writes. Review the UXC binding and linked command after use if you do not want the Notion connection to persist.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:34
Finding

OAuth Authorization Response Exposed Through Chat and Process Arguments

Content
View full analysis
--authorization-response ''` 3. Bind endpoint to the credential: ``` From `SKILL.md:55-63`: ```markdown ## OAuth Interaction Template Use this exact operator-facing flow: 1. Start login command and wait for authorization URL output. 2. Tell user: - Open this URL in browser and approve Notion access. - Copy the full callback URL from browser address bar. - Paste the callback URL back in chat. 3. Run `uxc auth oauth complete notion-mcp --session-id --authorization-response ''`. ``` From `references/oauth-and-binding.md:28-33`: ```bash After the user approves access, finish with: ```bash uxc auth oauth complete notion-mcp \ --session-id \ --authorization-response 'http://127.0.0.1:8788/callback?code=...&state=...' ``` ``` From `references/oauth-and-binding.md:39-45`: ```markdown ## Interactive Callback Handoff For agent-driven/manual runs: 1. Run the start command and capture the authorization URL plus `session_id` printed by `uxc`. 2. Ask the user to open the URL and approve access. 3. Ask the user to paste the full callback URL (for example: `http://127.0.0.1:8788/callback?code=...&state=...`). 4. Run `uxc auth oauth complete notion-mcp --sess ...[truncated 3655 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The declared description says this skill operates Notion workspace content through Notion MCP using the UXC CLI. However, the actual code chunk is only a repository validation script. It checks that documentation and agent config files exist and contain required strings and formatting. While those checks are related to the Notion MCP skill, they are meta-level validation behavior, not the described runtime functionality. This is a material purpose mismatch, not merely a supporting implementation detail.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

md
4. Optionally confirm success with:
   - `uxc auth oauth info <credential_id>`

Do not ask user to manually extract or copy bearer tokens. Token exchange is handled by `uxc`.
Use `uxc auth oauth login ... --flow authorization_code` only for a single-process interactive fallback.

## Guardrails

Static analysis

No suspicious patterns detected.