Notion Openapi Skill

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:49 AM UTC
• Version: 1.0.0

Overview

This is a coherent Notion API helper, but it warrants review because it can persist powerful Notion credentials, reuse another integration's credential, fetch a mutable schema URL, and perform confirmed writes or deletes in Notion.

Install only if you want an agent to read and modify Notion content through the REST API. Prefer a dedicated Notion integration token stored through an environment variable or secret store, connect it only to the Notion content you intend to expose, avoid the shared notion-mcp credential path unless you accept cross-tool side effects, and pin or review the OpenAPI schema before linking. Require explicit confirmation and a clear change summary before any page or block write, trash, or delete operation.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (16)

Credential Access

High

• Category: Privilege Escalation

Content

### Advanced: reuse the same OAuth credential as `notion-mcp`

This is technically possible in `uxc` if the existing credential already has a valid Notion OAuth access token.

Important:
- once an OAuth credential uses custom headers, include `Authorization=Bearer {{secret}}` explicitly

• Confidence: 83% confidence
• Finding: The skill encourages reusing an existing OAuth access token from another integration context (`notion-mcp`) and adding custom headers to that shared credential. Credential reuse across tools and hosts increases the chance of overbroad token exposure, accidental cross-context access, and misrouting of privileged secrets if bindings are misconfigured or logs reveal effective mappings.

Ae1

High

• Category: analysis-evasion

Content

- Curated OpenAPI schema: `references/notion-public.openapi.json`

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Intent-Code Divergence

Medium

• Confidence: 99% confidence
• Finding: The top-level description frames the schema as read/inspection oriented, but the paths also enable page creation, updates, block appends, trashing, and deletion-style operations. This mismatch can cause agents or users to authorize or invoke the skill under a false assumption of non-destructive behavior, increasing the chance of unintended data modification.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The schema exposes multiple destructive or state-changing operations such as page updates, block updates, appends, and block deletion/trashing without any embedded warning, confirmation guidance, or safety constraints. In an agent setting, this raises the risk of accidental or prompt-induced destructive actions against user content, especially because the API is authenticated and operates on live workspace data.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documentation explicitly suggests substituting the Notion API secret directly into a shell command, which can leak the token through shell history, process listings, terminal logging, or screenshots. Because this skill is designed to access and modify Notion content, exposure of that credential could allow unauthorized reading or writing of any resources the integration can access.

External Transmission

Medium

• Category: Data Exfiltration

Content

rg -q '^description:\s*.+' "${SKILL_FILE}" || fail 'missing description'

rg -q 'command -v notion-openapi-cli' "${SKILL_FILE}" || fail 'missing link-first command check'
rg -q 'uxc link notion-openapi-cli https://api.notion.com/v1 --schema-url ' "${SKILL_FILE}" || fail 'missing fixed link create command with schema-url'
rg -q 'notion-openapi-cli -h' "${SKILL_FILE}" || fail 'missing help-first host discovery example'
rg -q 'notion-openapi-cli post:/search -h' "${SKILL_FILE}" || fail 'missing operation-level help example'
rg -Fq 'notion-openapi-cli post:/pages -h' "${SKILL_FILE}" || fail 'missing page-create help example'

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

rg -q '^description:\s*.+' "${SKILL_FILE}" || fail 'missing description'

rg -q 'command -v notion-openapi-cli' "${SKILL_FILE}" || fail 'missing link-first command check'
rg -q 'uxc link notion-openapi-cli https://api.notion.com/v1 --schema-url ' "${SKILL_FILE}" || fail 'missing fixed link create command with schema-url'
rg -q 'notion-openapi-cli -h' "${SKILL_FILE}" || fail 'missing help-first host discovery example'
rg -q 'notion-openapi-cli post:/search -h' "${SKILL_FILE}" || fail 'missing operation-level help example'
rg -Fq 'notion-openapi-cli post:/pages -h' "${SKILL_FILE}" || fail 'missing page-create help example'

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

rg -q '^description:\s*.+' "${SKILL_FILE}" || fail 'missing description'

rg -q 'command -v notion-openapi-cli' "${SKILL_FILE}" || fail 'missing link-first command check'
rg -q 'uxc link notion-openapi-cli https://api.notion.com/v1 --schema-url ' "${SKILL_FILE}" || fail 'missing fixed link create command with schema-url'
rg -q 'notion-openapi-cli -h' "${SKILL_FILE}" || fail 'missing help-first host discovery example'
rg -q 'notion-openapi-cli post:/search -h' "${SKILL_FILE}" || fail 'missing operation-level help example'
rg -Fq 'notion-openapi-cli post:/pages -h' "${SKILL_FILE}" || fail 'missing page-create help example'

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

rg -q '^description:\s*.+' "${SKILL_FILE}" || fail 'missing description'

rg -q 'command -v notion-openapi-cli' "${SKILL_FILE}" || fail 'missing link-first command check'
rg -q 'uxc link notion-openapi-cli https://api.notion.com/v1 --schema-url ' "${SKILL_FILE}" || fail 'missing fixed link create command with schema-url'
rg -q 'notion-openapi-cli -h' "${SKILL_FILE}" || fail 'missing help-first host discovery example'
rg -q 'notion-openapi-cli post:/search -h' "${SKILL_FILE}" || fail 'missing operation-level help example'
rg -Fq 'notion-openapi-cli post:/pages -h' "${SKILL_FILE}" || fail 'missing page-create help example'

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

rg -q '^description:\s*.+' "${SKILL_FILE}" || fail 'missing description'

rg -q 'command -v notion-openapi-cli' "${SKILL_FILE}" || fail 'missing link-first command check'
rg -q 'uxc link notion-openapi-cli https://api.notion.com/v1 --schema-url ' "${SKILL_FILE}" || fail 'missing fixed link create command with schema-url'
rg -q 'notion-openapi-cli -h' "${SKILL_FILE}" || fail 'missing help-first host discovery example'
rg -q 'notion-openapi-cli post:/search -h' "${SKILL_FILE}" || fail 'missing operation-level help example'
rg -Fq 'notion-openapi-cli post:/pages -h' "${SKILL_FILE}" || fail 'missing page-create help example'

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

rg -q '^description:\s*.+' "${SKILL_FILE}" || fail 'missing description'

rg -q 'command -v notion-openapi-cli' "${SKILL_FILE}" || fail 'missing link-first command check'
rg -q 'uxc link notion-openapi-cli https://api.notion.com/v1 --schema-url ' "${SKILL_FILE}" || fail 'missing fixed link create command with schema-url'
rg -q 'notion-openapi-cli -h' "${SKILL_FILE}" || fail 'missing help-first host discovery example'
rg -q 'notion-openapi-cli post:/search -h' "${SKILL_FILE}" || fail 'missing operation-level help example'
rg -Fq 'notion-openapi-cli post:/pages -h' "${SKILL_FILE}" || fail 'missing page-create help example'

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

rg -q '^description:\s*.+' "${SKILL_FILE}" || fail 'missing description'

rg -q 'command -v notion-openapi-cli' "${SKILL_FILE}" || fail 'missing link-first command check'
rg -q 'uxc link notion-openapi-cli https://api.notion.com/v1 --schema-url ' "${SKILL_FILE}" || fail 'missing fixed link create command with schema-url'
rg -q 'notion-openapi-cli -h' "${SKILL_FILE}" || fail 'missing help-first host discovery example'
rg -q 'notion-openapi-cli post:/search -h' "${SKILL_FILE}" || fail 'missing operation-level help example'
rg -Fq 'notion-openapi-cli post:/pages -h' "${SKILL_FILE}" || fail 'missing page-create help example'

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

rg -q '^description:\s*.+' "${SKILL_FILE}" || fail 'missing description'

rg -q 'command -v notion-openapi-cli' "${SKILL_FILE}" || fail 'missing link-first command check'
rg -q 'uxc link notion-openapi-cli https://api.notion.com/v1 --schema-url ' "${SKILL_FILE}" || fail 'missing fixed link create command with schema-url'
rg -q 'notion-openapi-cli -h' "${SKILL_FILE}" || fail 'missing help-first host discovery example'
rg -q 'notion-openapi-cli post:/search -h' "${SKILL_FILE}" || fail 'missing operation-level help example'
rg -Fq 'notion-openapi-cli post:/pages -h' "${SKILL_FILE}" || fail 'missing page-create help example'

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

rg -q '^description:\s*.+' "${SKILL_FILE}" || fail 'missing description'

rg -q 'command -v notion-openapi-cli' "${SKILL_FILE}" || fail 'missing link-first command check'
rg -q 'uxc link notion-openapi-cli https://api.notion.com/v1 --schema-url ' "${SKILL_FILE}" || fail 'missing fixed link create command with schema-url'
rg -q 'notion-openapi-cli -h' "${SKILL_FILE}" || fail 'missing help-first host discovery example'
rg -q 'notion-openapi-cli post:/search -h' "${SKILL_FILE}" || fail 'missing operation-level help example'
rg -Fq 'notion-openapi-cli post:/pages -h' "${SKILL_FILE}" || fail 'missing page-create help example'

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

rg -q '^description:\s*.+' "${SKILL_FILE}" || fail 'missing description'

rg -q 'command -v notion-openapi-cli' "${SKILL_FILE}" || fail 'missing link-first command check'
rg -q 'uxc link notion-openapi-cli https://api.notion.com/v1 --schema-url ' "${SKILL_FILE}" || fail 'missing fixed link create command with schema-url'
rg -q 'notion-openapi-cli -h' "${SKILL_FILE}" || fail 'missing help-first host discovery example'
rg -q 'notion-openapi-cli post:/search -h' "${SKILL_FILE}" || fail 'missing operation-level help example'
rg -Fq 'notion-openapi-cli post:/pages -h' "${SKILL_FILE}" || fail 'missing page-create help example'

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Description-Behavior Mismatch

Low

• Confidence: 95% confidence
• Finding: The manifest and embedded schema description emphasize search, block traversal, page reads, content writes, and data source/database inspection, but this schema also exposes /users/me to retrieve the bot identity. That is a real capability outside the specifically enumerated functional areas, even though it is adjacent to API use.

Static analysis

No suspicious patterns detected.