ClawHub
Back to skill

Security audit

Notion Openapi Skill

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Notion API helper, but it warrants review because it can persist powerful Notion credentials, reuse another integration's credential, fetch a mutable schema URL, and perform confirmed writes or deletes in Notion.

Install only if you want an agent to read and modify Notion content through the REST API. Prefer a dedicated Notion integration token stored through an environment variable or secret store, connect it only to the Notion content you intend to expose, avoid the shared notion-mcp credential path unless you accept cross-tool side effects, and pin or review the OpenAPI schema before linking. Require explicit confirmation and a clear change summary before any page or block write, trash, or delete operation.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (16)

Credential Access

High
Category
Privilege Escalation
Confidence
83% confidence
Finding

The skill encourages reusing an existing OAuth access token from another integration context (notion-mcp) and adding custom headers to that shared credential. Credential reuse across tools and hosts increases the chance of overbroad token exposure, accidental cross-context access, and misrouting of privileged secrets if bindings are misconfigured or logs reveal effective mappings.

Content

Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.

md
### Advanced: reuse the same OAuth credential as `notion-mcp`

This is technically possible in `uxc` if the existing credential already has a valid Notion OAuth access token.

Important:
- once an OAuth credential uses custom headers, include `Authorization=Bearer {{secret}}` explicitly

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 231)May include surrounding context.

md
- Curated OpenAPI schema: `references/notion-public.openapi.json`

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

The top-level description frames the schema as read/inspection oriented, but the paths also enable page creation, updates, block appends, trashing, and deletion-style operations. This mismatch can cause agents or users to authorize or invoke the skill under a false assumption of non-destructive behavior, increasing the chance of unintended data modification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The schema exposes multiple destructive or state-changing operations such as page updates, block updates, appends, and block deletion/trashing without any embedded warning, confirmation guidance, or safety constraints. In an agent setting, this raises the risk of accidental or prompt-induced destructive actions against user content, especially because the API is authenticated and operates on live workspace data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The documentation explicitly suggests substituting the Notion API secret directly into a shell command, which can leak the token through shell history, process listings, terminal logging, or screenshots. Because this skill is designed to access and modify Notion content, exposure of that credential could allow unauthorized reading or writing of any resources the integration can access.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

md
rg -q '^description:\s*.+' "${SKILL_FILE}" || fail 'missing description'

rg -q 'command -v notion-openapi-cli' "${SKILL_FILE}" || fail 'missing link-first command check'
rg -q 'uxc link notion-openapi-cli https://api.notion.com/v1 --schema-url ' "${SKILL_FILE}" || fail 'missing fixed link create command with schema-url'
rg -q 'notion-openapi-cli -h' "${SKILL_FILE}" || fail 'missing help-first host discovery example'
rg -q 'notion-openapi-cli post:/search -h' "${SKILL_FILE}" || fail 'missing operation-level help example'
rg -Fq 'notion-openapi-cli post:/pages -h' "${SKILL_FILE}" || fail 'missing page-create help example'

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

md
rg -q '^description:\s*.+' "${SKILL_FILE}" || fail 'missing description'

rg -q 'command -v notion-openapi-cli' "${SKILL_FILE}" || fail 'missing link-first command check'
rg -q 'uxc link notion-openapi-cli https://api.notion.com/v1 --schema-url ' "${SKILL_FILE}" || fail 'missing fixed link create command with schema-url'
rg -q 'notion-openapi-cli -h' "${SKILL_FILE}" || fail 'missing help-first host discovery example'
rg -q 'notion-openapi-cli post:/search -h' "${SKILL_FILE}" || fail 'missing operation-level help example'
rg -Fq 'notion-openapi-cli post:/pages -h' "${SKILL_FILE}" || fail 'missing page-create help example'

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

md
rg -q '^description:\s*.+' "${SKILL_FILE}" || fail 'missing description'

rg -q 'command -v notion-openapi-cli' "${SKILL_FILE}" || fail 'missing link-first command check'
rg -q 'uxc link notion-openapi-cli https://api.notion.com/v1 --schema-url ' "${SKILL_FILE}" || fail 'missing fixed link create command with schema-url'
rg -q 'notion-openapi-cli -h' "${SKILL_FILE}" || fail 'missing help-first host discovery example'
rg -q 'notion-openapi-cli post:/search -h' "${SKILL_FILE}" || fail 'missing operation-level help example'
rg -Fq 'notion-openapi-cli post:/pages -h' "${SKILL_FILE}" || fail 'missing page-create help example'

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 144)May include surrounding context.

md
rg -q '^description:\s*.+' "${SKILL_FILE}" || fail 'missing description'

rg -q 'command -v notion-openapi-cli' "${SKILL_FILE}" || fail 'missing link-first command check'
rg -q 'uxc link notion-openapi-cli https://api.notion.com/v1 --schema-url ' "${SKILL_FILE}" || fail 'missing fixed link create command with schema-url'
rg -q 'notion-openapi-cli -h' "${SKILL_FILE}" || fail 'missing help-first host discovery example'
rg -q 'notion-openapi-cli post:/search -h' "${SKILL_FILE}" || fail 'missing operation-level help example'
rg -Fq 'notion-openapi-cli post:/pages -h' "${SKILL_FILE}" || fail 'missing page-create help example'

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 152)May include surrounding context.

md
rg -q '^description:\s*.+' "${SKILL_FILE}" || fail 'missing description'

rg -q 'command -v notion-openapi-cli' "${SKILL_FILE}" || fail 'missing link-first command check'
rg -q 'uxc link notion-openapi-cli https://api.notion.com/v1 --schema-url ' "${SKILL_FILE}" || fail 'missing fixed link create command with schema-url'
rg -q 'notion-openapi-cli -h' "${SKILL_FILE}" || fail 'missing help-first host discovery example'
rg -q 'notion-openapi-cli post:/search -h' "${SKILL_FILE}" || fail 'missing operation-level help example'
rg -Fq 'notion-openapi-cli post:/pages -h' "${SKILL_FILE}" || fail 'missing page-create help example'

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 226)May include surrounding context.

md
rg -q '^description:\s*.+' "${SKILL_FILE}" || fail 'missing description'

rg -q 'command -v notion-openapi-cli' "${SKILL_FILE}" || fail 'missing link-first command check'
rg -q 'uxc link notion-openapi-cli https://api.notion.com/v1 --schema-url ' "${SKILL_FILE}" || fail 'missing fixed link create command with schema-url'
rg -q 'notion-openapi-cli -h' "${SKILL_FILE}" || fail 'missing help-first host discovery example'
rg -q 'notion-openapi-cli post:/search -h' "${SKILL_FILE}" || fail 'missing operation-level help example'
rg -Fq 'notion-openapi-cli post:/pages -h' "${SKILL_FILE}" || fail 'missing page-create help example'

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/notion-public.openapi.json (reported line 10)May include surrounding context.

json
rg -q '^description:\s*.+' "${SKILL_FILE}" || fail 'missing description'

rg -q 'command -v notion-openapi-cli' "${SKILL_FILE}" || fail 'missing link-first command check'
rg -q 'uxc link notion-openapi-cli https://api.notion.com/v1 --schema-url ' "${SKILL_FILE}" || fail 'missing fixed link create command with schema-url'
rg -q 'notion-openapi-cli -h' "${SKILL_FILE}" || fail 'missing help-first host discovery example'
rg -q 'notion-openapi-cli post:/search -h' "${SKILL_FILE}" || fail 'missing operation-level help example'
rg -Fq 'notion-openapi-cli post:/pages -h' "${SKILL_FILE}" || fail 'missing page-create help example'

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/usage-patterns.md (reported line 12)May include surrounding context.

md
rg -q '^description:\s*.+' "${SKILL_FILE}" || fail 'missing description'

rg -q 'command -v notion-openapi-cli' "${SKILL_FILE}" || fail 'missing link-first command check'
rg -q 'uxc link notion-openapi-cli https://api.notion.com/v1 --schema-url ' "${SKILL_FILE}" || fail 'missing fixed link create command with schema-url'
rg -q 'notion-openapi-cli -h' "${SKILL_FILE}" || fail 'missing help-first host discovery example'
rg -q 'notion-openapi-cli post:/search -h' "${SKILL_FILE}" || fail 'missing operation-level help example'
rg -Fq 'notion-openapi-cli post:/pages -h' "${SKILL_FILE}" || fail 'missing page-create help example'

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/usage-patterns.md (reported line 161)May include surrounding context.

md
rg -q '^description:\s*.+' "${SKILL_FILE}" || fail 'missing description'

rg -q 'command -v notion-openapi-cli' "${SKILL_FILE}" || fail 'missing link-first command check'
rg -q 'uxc link notion-openapi-cli https://api.notion.com/v1 --schema-url ' "${SKILL_FILE}" || fail 'missing fixed link create command with schema-url'
rg -q 'notion-openapi-cli -h' "${SKILL_FILE}" || fail 'missing help-first host discovery example'
rg -q 'notion-openapi-cli post:/search -h' "${SKILL_FILE}" || fail 'missing operation-level help example'
rg -Fq 'notion-openapi-cli post:/pages -h' "${SKILL_FILE}" || fail 'missing page-create help example'

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/validate.sh (reported line 35)May include surrounding context.

sh
rg -q '^description:\s*.+' "${SKILL_FILE}" || fail 'missing description'

rg -q 'command -v notion-openapi-cli' "${SKILL_FILE}" || fail 'missing link-first command check'
rg -q 'uxc link notion-openapi-cli https://api.notion.com/v1 --schema-url ' "${SKILL_FILE}" || fail 'missing fixed link create command with schema-url'
rg -q 'notion-openapi-cli -h' "${SKILL_FILE}" || fail 'missing help-first host discovery example'
rg -q 'notion-openapi-cli post:/search -h' "${SKILL_FILE}" || fail 'missing operation-level help example'
rg -Fq 'notion-openapi-cli post:/pages -h' "${SKILL_FILE}" || fail 'missing page-create help example'

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest and embedded schema description emphasize search, block traversal, page reads, content writes, and data source/database inspection, but this schema also exposes /users/me to retrieve the bot identity. That is a real capability outside the specifically enumerated functional areas, even though it is adjacent to API use.

Content

No source excerpt is available for this finding.