ClawHub
Back to skill

Security audit

Notion

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Notion MCP connector that stores user-provided OAuth tokens locally so agents can read and update the connected Notion workspace with user intent.

Install this only for a Notion workspace/account you intend the agent to access. Treat it like granting that account's Notion permissions to the agent, confirm write requests carefully, and revoke the OAuth grant in Notion when no longer needed or when rotating accounts.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding
The declared description says this skill is for interacting with Notion workspace content through Notion's MCP server. The actual code does not search, read, update, or otherwise interact with Notion pages, databases, blocks, comments, or workspace data. Instead, it initializes OAuth state for an MCP server by extracting tokens/client credentials from environment variables, building a JSON payload, and storing it in mcporter's vault. That is a materially different primary purpose and capability set. While OAuth setup could be a supporting detail somewhere in a larger integration, this code chunk itself is specifically credential seeding infrastructure, not a thin Notion MCP pass-through.

Credential Access

High
Category
Privilege Escalation
Content
- `MAVERICK_NOTION_MCP_EXPIRES_IN`
- `MAVERICK_NOTION_MCP_REFRESH_TOKEN_EXPIRES_AT`

These expiry fields are vault metadata, not tool arguments. They let mcporter make better pre-request refresh decisions for the access token and preserve refresh-token expiry information when the upstream OAuth response includes it.

**Setup-time prerequisites.** Setup needs `bash`, `jq`, and `mcporter` (>= v0.11.0) on `PATH`. These are gated by the install caller, not by `requires.bins` in this file, which gates agent-runtime eligibility. If setup fails, verify those binaries are present and current before retrying.
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Unrestricted Tool Access

Medium
Category
Excessive Agency
Content
The output includes the server's `Instructions:` field (read it) and a JSON Schema for every tool's parameters. Treat this as the authoritative reference for the rest of the session.

**Step 2 - Call any tool from the catalog** using the form `maverick-notion.<tool>`:

```sh
mcporter --config {baseDir}/mcporter.json call maverick-notion.<tool> <arg>=<value> ...
Confidence
80% confidence
Finding
The skill instructs the agent to enumerate the live tool catalog from a remote MCP server and then permits calling any advertised tool as authoritative. That creates an overly broad trust boundary: if the remote server exposes unexpected, newly added, or high-risk tools, the agent may invoke them without a locally pinned allowlist or explicit per-tool risk controls.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
scripts/init-mcporter-oauth.sh:77