ClawHub
Back to skill

Security audit

notipo

Security checks for vulnerabilities and agentic risk

Overview

This Notipo skill matches its publishing purpose, but it needs review because it can publish, update, and delete connected WordPress/Notion content through a persistent global CLI and API key.

Install only if you want an agent to manage posts on your connected Notion and WordPress accounts. Prefer draft creation by default, require explicit approval before using --publish, update, sync, or delete, verify NOTIPO_URL is a trusted HTTPS Notipo endpoint, and use a narrow, revocable API key. Consider pinning or isolating the CLI install instead of installing the latest package globally.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:8
Finding

Unpinned Global Installation of a Third-Party npm Package

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 8-12
Vulnerability Type: Unpinned third-party dependency installed globally
Risk Level: Medium

bash
## Install Notipo CLI if it doesn't exist

```bash
npm install -g notipo
text

### Technical Analysis

The installation instruction retrieves the latest available version of the `notipo` npm package without pinning a reviewed version or verifying package integrity. The `-g` option installs the package into the global npm environment rather than isolating it within the project.

npm installation may execute package lifecycle scripts. Consequently, the effective code executed by this instruction can change after the Skill has been reviewed. A compromised npm maintainer account, malicious package release, or future vulnerable version could result in arbitrary code running with the privileges of the user performing the installation.

Although installing the CLI supports the Skill's declared publishing functionality, using an unpinned global installation grants the dependency broader and less predictable access than is necessary.

### Attack Path

1. An attacker compromises the npm package, its maintainer account, or the package publication process.
2. The attacker publishes a malicious version under the legitimate `notipo` package name.
3. A user or agent follows the Skill instruction and runs `npm install -g notipo`.
4. npm retrieves the current malicious version because no version is pinned.
5. Malicious package code or lifecycle scripts execute with the installing user's privileges.
6. The installed global executable can subsequently process API credentials, post content, and publishing operations.

### Impact Assessment

Successful exploitation could provide arbitrary code execution under the account running npm. Depending on that account's permissions, an attacker could access environment variables such as `NOTIPO_API_KEY`, read or modify user-
...[truncated 186 chars]
Remediation
View remediation

Remediation Suggestions

  • Pin the dependency to a specifically reviewed version rather than installing the latest release.
  • Prefer a project-local dependency with a committed lockfile over a global installation.
  • Verify package provenance and registry integrity before installation.
  • Use npm integrity controls and periodically review the pinned package and its transitive dependencies.
  • Run installation and the CLI under a non-privileged account.
  • Disable lifecycle scripts during installation when they are not required, then explicitly review any required scripts.
  • Document the expected package publisher, version, and cryptographic integrity value so users can detect unexpected releases.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:38
Finding

API Credential Transmission to an Unvalidated Configurable Destination

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 21-26 and 38-46
Vulnerability Type: Unvalidated network destination for sensitive credentials
Risk Level: Medium

bash
export NOTIPO_URL="https://notipo.com"
export NOTIPO_API_KEY="ntp_your-api-key"
bash
# Get available categories (for picking a valid category)
curl -s $NOTIPO_URL/api/categories \
  -H "X-API-Key: $NOTIPO_API_KEY" | jq '.data[].name'

# Get available tags
curl -s $NOTIPO_URL/api/tags \
  -H "X-API-Key: $NOTIPO_API_KEY" | jq '.data[].name'

The same configurable destination is also used for authenticated post submissions in SKILL.md, including lines 80-95 and 151-168.

Technical Analysis

Sending the API key and blog content to Notipo is necessary for the declared publishing workflow, and the documented default destination uses HTTPS. However, authenticated requests derive their destination entirely from the mutable NOTIPO_URL environment variable. The instructions do not validate the URL scheme or hostname before attaching the X-API-Key header.

If the environment variable is poisoned, inherited from an untrusted environment, or changed through copied configuration, the requests can disclose the API key to an attacker-controlled endpoint. A non-HTTPS value could also transmit credentials and content without transport encryption.

The URL expansion is additionally unquoted. A malicious value beginning with a curl option could affect command-line parsing, while shell metacharacters contained inside a variable are not reparsed as shell syntax. The principal risk remains credential disclosure through destination redirection.

Attack Path

  1. An attacker gains influence over the process environment, setup instructions, shell profile, CI configuration, or copied NOTIPO_URL value.
  2. The attacker changes NOTIPO_URL to an attacker-controlled endpoint or an insecure HTTP endpoint.
  3. The user or agent exec ...[truncated 1081 chars]
Remediation
View remediation

Remediation Suggestions

  • Use a fixed trusted API origin when endpoint customization is not required.
  • If customization is required, validate the URL before every authenticated request.
  • Require HTTPS and reject plaintext HTTP, embedded credentials, unexpected ports, redirects to untrusted origins, and hostnames outside an explicit allowlist.
  • Quote URL expansions, for example: curl -s -- "${NOTIPO_URL%/}/api/categories".
  • Place -- before positional URL arguments to prevent values from being interpreted as curl options.
  • Configure curl to reject unsafe redirects or ensure credentials are never forwarded across origins.
  • Store the API key in a dedicated secret manager where available and provide it only to the publishing process.
  • Use a narrowly scoped, revocable API key and rotate it immediately if destination poisoning or disclosure is suspected.
  • Avoid verbose shell tracing and ensure logs do not record authorization headers or request secrets.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill description includes notipo posts delete POST_ID, which is a destructive operation affecting user data. Although the CLI reference later notes it cleans up WordPress and Notion, the delete example itself is presented without a nearby warning or confirmation note, which is insufficient disclosure for a destructive action in markdown guidance.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill explicitly documents --publish and --publish --wait flows that make content live immediately, but it does not provide an explicit warning or confirmation guidance about publishing AI-generated content to a public WordPress site. In an agent context, this increases the chance of accidental public posting of unreviewed, incorrect, or policy-violating content.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

The --wait flag polls until the job completes and returns the result with the WordPress URL.

Create with inline Unsplash images (Pro plan, curl only)

bash
curl -X POST $NOTIPO_URL/api/posts/create \

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 183)May include surrounding context.

Full pipeline with inline images (curl)

bash
curl -X POST $NOTIPO_URL/api/posts/create \
  -H "X-API-Key: $NOTIPO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

Static analysis

No suspicious patterns detected.