ClawHub
Back to skill

Security audit

Cli Notion

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward Notion CLI skill that reads and creates Notion pages using a user-provided Notion API key, with some documentation gaps around secret handling and live workspace writes.

Install only if you intend to connect an agent or CLI to your Notion workspace. Use a least-privilege Notion integration, avoid pasting the API key into shared logs or terminals, and test create-page against a non-production database before allowing agent-driven writes.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (11)

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The README explicitly instructs users or agents to create Notion pages through the API but does not warn that this operation mutates data in the connected workspace. In an agent-execution context, missing disclosure about write side effects can lead to unintended creation of records, clutter, or modification of production knowledge bases when a user expects read-only behavior.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill documents commands that can create and read Notion content but does not warn users that running the tool may modify live workspace data. This increases the chance of unintended destructive or privacy-impacting actions because an agent or user may treat the commands as harmless documentation rather than operations against a real external service.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The installation section instructs users to export a Notion API key but provides no privacy or secret-handling guidance. This can lead to credential leakage through shell history, screenshots, logs, shared terminals, or misuse by agents that do not treat the value as sensitive.

Natural-Language Policy Violations

Medium
Confidence
94% confidence
Finding
The file’s user-facing description and command/help text are written in Chinese, and there is no indication that another language is supported or that Chinese is an intentional opt-in. This can violate language/locale policy when a skill imposes a specific language on users without choice or documented justification.

External Transmission

Medium
Category
Data Exfiltration
Content
click.echo("✗ 错误：需要 NOTION_API_KEY")
        return
    
    url = 'https://api.notion.com/v1/pages'
    data = {
        "parent": {"database_id": parent},
        "properties": {
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
click.echo("✗ 错误：需要 NOTION_API_KEY")
        return
    
    url = 'https://api.notion.com/v1/pages'
    data = {
        "parent": {"database_id": parent},
        "properties": {
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
click.echo("✗ 错误：需要 NOTION_API_KEY")
        return
    
    url = 'https://api.notion.com/v1/pages'
    data = {
        "parent": {"database_id": parent},
        "properties": {
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
click.echo("✗ 错误：需要 NOTION_API_KEY")
        return
    
    url = 'https://api.notion.com/v1/pages'
    data = {
        "parent": {"database_id": parent},
        "properties": {
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
}
    
    try:
        response = requests.post(url, headers=ctx.obj['headers'], json=data)
        response.raise_for_status()
        result = response.json()
Confidence
80% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Natural-Language Policy Violations

Low
Confidence
93% confidence
Finding
The natural-language instructions and headings indicate the skill is presented in Chinese, but there is no opt-in, alternative language option, or justification for a locale-specific constraint. Under the stated policy, forcing a specific language without user choice can be a policy violation.

Natural-Language Policy Violations

Low
Confidence
91% confidence
Finding
The skill documentation is written in Chinese and does not indicate any language choice, opt-in, or region-specific justification. Per the policy, forcing a specific language or locale without user opt-in can be a natural-language policy violation.

Static analysis

No suspicious patterns detected.