ClawHub

Korta Notion

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward Notion API helper, but users should protect the Notion API key it asks them to store locally.

Install only if you are comfortable giving an agent access to the Notion pages or databases shared with the integration. Use a least-privilege Notion integration, share only the needed pages/databases, avoid storing the key in shell history or synced folders, prefer an OS secret store when possible, and if using ~/.config/notion/api_key set restrictive permissions such as chmod 600 and rotate the key if exposed.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill instructs users to store a long-lived Notion API token in plaintext under ~/.config/notion/api_key without mentioning file permissions, OS keychains, rotation, or the sensitivity of the secret. While this is a common convenience pattern, it increases the chance of local credential disclosure through other local users, backups, shell tooling, or unrelated malware reading the file.

Session Persistence

Medium
Category
Rogue Agent
Content
## Setup

1. Create an integration at https://notion.so/my-integrations
2. Copy the API key (starts with `ntn_` or `secret_`)
3. Store it:
```bash
Confidence
91% confidence
Finding
Create an integration at https://notion.so/my-integrations 2. Copy the API key (starts with `ntn_` or `secret_`) 3. Store it: ```bash mkdir -p ~/.config/notion echo "ntn_your_key_here" > ~/.config/not

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal