ClawHub
Back to skill

Security audit

MH notion

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward Notion API helper skill, but users should protect the Notion token it asks them to store locally.

Install only if you intend to let an agent use a Notion integration. Create the integration with minimum capabilities, share only the specific pages or databases needed, and store the token in a secret manager or a file with owner-only permissions rather than a broadly readable plaintext file.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:18
Finding

Notion API Token Stored Without Explicitly Restrictive File Permissions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 18-19
Vulnerability Type: Plaintext sensitive credential stored without enforced access controls
Risk Level: Medium

Vulnerable Code:

bash
mkdir -p ~/.config/notion
echo "ntn_your_key_here" > ~/.config/notion/api_key

Technical Analysis

The setup instructions store a Notion API bearer token in a plaintext file but do not enforce restrictive permissions on either the configuration directory or the token file. The resulting permissions depend on the user's current umask and any pre-existing directory configuration.

In an environment with a permissive umask, shared home directory permissions, or an already accessible ~/.config/notion directory, another local user or process may be able to read the token. Because the token is subsequently used as an HTTP Authorization: Bearer credential, possession of it is sufficient to authenticate as the Notion integration.

Attack Path

  1. A victim follows the documented setup instructions and writes a valid Notion integration token to ~/.config/notion/api_key.
  2. The victim's environment applies permissive permissions to the directory or file because the instructions do not set an explicit mode.
  3. An untrusted local user or process reads the plaintext token file.
  4. The attacker submits requests to https://api.notion.com/v1/ with the stolen token in the Authorization: Bearer header.
  5. The attacker reads or modifies resources shared with the compromised integration, subject to its configured Notion capabilities.

Impact Assessment

Successful exploitation exposes the privileges granted to the Notion integration. Depending on its capabilities and the resources shared with it, an attacker may be able to read sensitive pages and database records, create content, alter page properties, append blocks, or otherwise modify accessible workspace data.

The compromise is limited to resou ...[truncated 242 chars]

Remediation
View remediation

Remediation Suggestions

Enforce owner-only permissions when creating the credential directory and file:

bash
install -d -m 700 ~/.config/notion
(umask 077; printf '%s\n' "$NOTION_API_KEY" > ~/.config/notion/api_key)
chmod 600 ~/.config/notion/api_key

Prefer obtaining the credential from the declared NOTION_API_KEY environment variable or a platform-supported secret manager rather than persisting it in plaintext. The documentation should also advise users to:

  • Avoid passing the secret directly as a command-line argument.
  • Verify that the credential file is not included in backups, logs, or source control.
  • Grant the Notion integration only the minimum required capabilities and page access.
  • Rotate the token immediately if local disclosure is suspected.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (12)

Session Persistence

Medium
Category
Rogue Agent
Confidence
93% confidence
Finding

The skill encourages long-lived session/credential persistence by saving the Notion API key to a local file, which can make compromise durable across sessions and increase exposure through local theft, backups, or shared accounts. In this context, the persistence is not strictly malicious, but it lacks safeguards and effectively normalizes insecure token storage.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

md
## Setup

1. Create an integration at https://notion.so/my-integrations
2. Copy the API key (starts with `ntn_` or `secret_`)
3. Store it:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The setup instructions tell users to persist a live Notion API key in a plaintext file under ~/.config/notion/api_key without any warning about filesystem permissions, local compromise risk, backups, or multi-user exposure. While common in simple CLI examples, this still increases credential exposure and can lead to unauthorized access to the user's Notion workspace if the file is read by another process, user, backup system, or malware.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

bash
NOTION_KEY=$(cat ~/.config/notion/api_key)
curl -X GET "https://api.notion.com/v1/..." \
  -H "Authorization: Bearer $NOTION_KEY" \
  -H "Notion-Version: 2025-09-03" \
  -H "Content-Type: application/json"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

bash
NOTION_KEY=$(cat ~/.config/notion/api_key)
curl -X GET "https://api.notion.com/v1/..." \
  -H "Authorization: Bearer $NOTION_KEY" \
  -H "Notion-Version: 2025-09-03" \
  -H "Content-Type: application/json"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

bash
NOTION_KEY=$(cat ~/.config/notion/api_key)
curl -X GET "https://api.notion.com/v1/..." \
  -H "Authorization: Bearer $NOTION_KEY" \
  -H "Notion-Version: 2025-09-03" \
  -H "Content-Type: application/json"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

bash
NOTION_KEY=$(cat ~/.config/notion/api_key)
curl -X GET "https://api.notion.com/v1/..." \
  -H "Authorization: Bearer $NOTION_KEY" \
  -H "Notion-Version: 2025-09-03" \
  -H "Content-Type: application/json"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

bash
NOTION_KEY=$(cat ~/.config/notion/api_key)
curl -X GET "https://api.notion.com/v1/..." \
  -H "Authorization: Bearer $NOTION_KEY" \
  -H "Notion-Version: 2025-09-03" \
  -H "Content-Type: application/json"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.

bash
NOTION_KEY=$(cat ~/.config/notion/api_key)
curl -X GET "https://api.notion.com/v1/..." \
  -H "Authorization: Bearer $NOTION_KEY" \
  -H "Notion-Version: 2025-09-03" \
  -H "Content-Type: application/json"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.

bash
NOTION_KEY=$(cat ~/.config/notion/api_key)
curl -X GET "https://api.notion.com/v1/..." \
  -H "Authorization: Bearer $NOTION_KEY" \
  -H "Notion-Version: 2025-09-03" \
  -H "Content-Type: application/json"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 103)May include surrounding context.

bash
NOTION_KEY=$(cat ~/.config/notion/api_key)
curl -X GET "https://api.notion.com/v1/..." \
  -H "Authorization: Bearer $NOTION_KEY" \
  -H "Notion-Version: 2025-09-03" \
  -H "Content-Type: application/json"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 121)May include surrounding context.

bash
NOTION_KEY=$(cat ~/.config/notion/api_key)
curl -X GET "https://api.notion.com/v1/..." \
  -H "Authorization: Bearer $NOTION_KEY" \
  -H "Notion-Version: 2025-09-03" \
  -H "Content-Type: application/json"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 131)May include surrounding context.

bash
NOTION_KEY=$(cat ~/.config/notion/api_key)
curl -X GET "https://api.notion.com/v1/..." \
  -H "Authorization: Bearer $NOTION_KEY" \
  -H "Notion-Version: 2025-09-03" \
  -H "Content-Type: application/json"

Static analysis

No suspicious patterns detected.