Security audit
Security checks for vulnerabilities and agentic risk
This is a straightforward Notion integration that uses a Notion API key to search, query, and create Notion pages, with no evidence of hidden or unrelated behavior.
Install only if you are comfortable giving this skill a Notion integration token. Share only the Notion pages or databases it needs, treat NOTION_API_KEY as a secret, and confirm page-creation requests before letting an agent write content to Notion.
The skill declares use of an environment secret and network-capable code but does not define any explicit tool scope such as permissions or allowed-tools. This creates an over-permissive trust boundary where an agent runtime may grant broader access than necessary, increasing the risk of secret exposure or unintended outbound requests if the implementation is modified or behaves unexpectedly.
The manifest exposes a content-modifying capability via notion_create_page but provides no user-facing warning or constraint about when writes to Notion should occur. In an agent setting, this can lead to unintended page creation, spam, or unauthorized content changes if the skill is invoked from ambiguous prompts or without explicit confirmation.
The skill explicitly supports creating pages and querying/searching databases in an external SaaS system, but the instructions do not warn that use of the skill can create or modify third-party data. This can mislead users or agents into taking state-changing actions without adequate confirmation, increasing the risk of unintended data creation, modification, or disclosure in Notion.
The instructions tell users to set a NOTION_API_KEY but provide no guidance on secure credential handling. This increases the chance that users expose the API key in prompts, logs, screenshots, shell history, or insecure environment configurations, which could allow unauthorized access to Notion workspaces and their contents.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
from typing import Optional, Dict, Any, List
NOTION_API_KEY = os.getenv("NOTION_API_KEY", "")
BASE_URL = "https://api.notion.com/v1"
class NotionClient:
The create_page function transmits the provided title and content to the Notion API using requests.post, which can affect user data and privacy. In this code file there is no confirmation prompt, user-facing disclosure, or warning string indicating that the content will be sent to an external service.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
try:
loop = asyncio.get_event_loop()
resp = await loop.run_in_executor(None, lambda: requests.post(url, headers=self.headers, json=payload, timeout=30))
data = resp.json()
if resp.status_code == 200:
return {"success": True, "page_id": data.get("id")}
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
try:
loop = asyncio.get_event_loop()
resp = await loop.run_in_executor(None, lambda: requests.post(url, headers=self.headers, json=payload, timeout=30))
data = resp.json()
if resp.status_code == 200:
return {"success": True, "page_id": data.get("id")}
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
try:
loop = asyncio.get_event_loop()
resp = await loop.run_in_executor(None, lambda: requests.post(url, headers=self.headers, json=payload, timeout=30))
data = resp.json()
if resp.status_code == 200:
return {"success": True, "page_id": data.get("id")}
The query_database function issues a network request to the Notion API that retrieves database contents from the user's workspace. The code contains no visible warning, prompt, or disclosure that workspace data will be accessed from an external service.
The description 'Manage pages, databases, and content in Notion' is broad and does not define safe invocation boundaries, making it easier for an agent to over-select this skill for loosely related requests. Because the skill includes both read and write actions, vague scope increases the chance of unnecessary access to Notion data or accidental modifications.
The search function sends the user's query to the Notion API via an HTTP request, but there is no confirmation prompt, print/log disclosure, or explanatory docstring in this file. Because search terms may contain sensitive information, users should be informed before transmission.
No suspicious patterns detected.