Notion Mvp

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:50 PM UTC
• Version: 1.0.0

Overview

This Notion task skill mostly does what it claims, but it has under-disclosed multi-database reads/writes and exposes Notion data and tokens through local process arguments.

Review this carefully before installing. Use a least-privilege Notion integration limited only to the intended task databases, avoid mapping sensitive databases such as CRM unless truly needed, and be aware that adding or querying tasks will contact Notion and may expose token or task details to local process-inspection tools on shared systems.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/notion_mvp.sh:19

Finding

Notion Integration Token Exposed Through Process Arguments

Content

View full analysis

/cmdline`, subject to the operating system's process-visibility controls. Environment-variable storage alone does not prevent this issue because the shell expansion copies the secret into curl's argument vector. The exposure occurs for every Notion API request made by the script. ### Attack Path 1. A user configures a valid Notion integration token and invokes the Skill. 2. The `request` function expands the token into the curl process's arguments. 3. A local attacker capable of observing the user's process arguments monitors process creation or repeatedly inspects the relevant process table. 4. The attacker captures the `Authorization: Bearer ...` argument while curl is active. 5. The attacker submits independent requests to the Notion API using the stolen bearer token. 6. The attacker can access or modify resources available to the compromised Notion integration. This path requires local process-observation capability and is affected by operating-system restrictions on cross-process inspection. ### Impact Asses ...[truncated 592 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/notion_mvp.sh:67

Finding

Sensitive Notion Content Exposed Through Node.js Process Arguments

Content

View full analysis

({name,type:val.type})); const findByNamesAndType = (names, types) => entries.find(e => names.includes(e.name) && types.includes(e.type)); const findByType = (types) => entries.find(e => types.includes(e.type)); const title = findByType(["title"]); const date = findByNamesAndType(["Data","Date"],["date"]) || findByType(["date"]); const time = findByNamesAndType(["Hora","Time"],["rich_text","title"]) || findByNamesAndType(["Hora","Time"],["select"]); const location = findByNamesAndType(["Local","Location"],["rich_text","title"]) || findByNamesAndType(["Local","Location"],["select"]); const weekday = findByNamesAndType(["Dia da semana","Dia","Weekday"],["rich_text","select"]); console.log(JSON.stringify({ title: title?.name || null, date: date?.name || null, time: time?.name || null, location: location?.name || null, weekday: weekday?.name || null, weekdayType: weekday?.type || null })); ' "$raw" } ``` User-provided task data and generated property information are similarly passed through argv: ```bash payload="$(node -e ' const [bloco,data,hora,localTxt,db,propsRaw] = process.argv.slice(1); const props = JSON.parse(propsRaw); if (!props.title || !props.date) { process.stderr.write("Database precisa de coluna title + date (ex.: Bloco e Data).\n"); process.exit(2); } const p = { parent: { database_id: db }, pr ...[truncated 4133 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The manifest says the skill creates and lists tasks in a single Notion database, but the documentation expands this to multiple databases and additional read capabilities such as query/search. This mismatch undermines informed consent and can cause the agent to access or modify broader Notion data than the user intended, especially when aliases map to unrelated datasets like CRM.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill invokes shell commands and relies on environment variables containing a Notion integration token, but it does not declare any tool scope such as allowed tools or permissions. That makes the operational boundary unclear and increases the risk of unintended shell execution or secret access beyond what a user would reasonably expect from the manifest.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill metadata presents a single-database task tool, while the body states it can read and write across multiple Notion databases via aliases. This discrepancy can mislead users and higher-level orchestration into granting broader access than expected, increasing the chance of accidental cross-database data exposure or modification.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Broad activation wording such as using the skill whenever the user asks to add tasks or capture quick todos may overlap with ordinary conversation and trigger the skill when the user did not intend external actions. In a write-capable integration, over-broad triggering can lead to unintended creation or retrieval of records in Notion.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill is designed to transmit user-entered task content, dates, times, and locations to an external SaaS service, but it does not include a user-facing warning or consent language about external storage. This is dangerous because users may unknowingly disclose personal or sensitive scheduling information to Notion and across potentially multiple databases.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/notion_mvp.sh (reported line 6)May include surrounding context.

sh

: "${NOTION_TOKEN:?Missing NOTION_TOKEN}"

api="https://api.notion.com/v1"
version="2022-06-28"

cmd="${1:-}"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The request helper silently sends authenticated network requests using a bearer token, but there is no built-in disclosure, confirmation, or logging for the user. In an agent setting, hidden credential-backed outbound requests reduce informed consent and make it easier to exfiltrate or query remote data without the user understanding that an external service is being contacted.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/notion_mvp.sh (reported line 20)May include surrounding context.

sh

local data="${1:-}"

  if [[ -n "$data" ]]; then
    curl -sS -X "$method" "$url" \
      -H "Authorization: Bearer $NOTION_TOKEN" \
      -H "Notion-Version: $version" \
      -H "Content-Type: application/json" \

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The description claims operation on a single database, but the code resolves arbitrary aliases from NOTION_DATABASE_MAP and can access multiple databases. This discrepancy weakens transparency and can lead to overbroad access if an agent assumes the tool is limited to one task database while it can actually touch any mapped Notion database.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The add command performs a remote write to Notion immediately after constructing the payload, with no confirmation or explicit warning that data will be stored externally. In an assistant workflow, this can cause accidental persistence of sensitive or incorrect user content to a third-party system.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill metadata says it creates and lists Notion tasks, but the implementation also supports arbitrary title substring search and a generic 'next' retrieval over database contents. This capability mismatch can cause an agent or user to authorize the skill under a narrower data-access assumption than what the code actually performs, increasing the risk of unintended data exposure from Notion databases.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.