Notion Enhanced

• Outcome: Pass
• Latest audit: Jul 10, 2026 · 3:54 AM UTC
• Version: 0.1.0

Overview

This appears to be a legitimate Notion connector, but it can change the Notion pages you share with it and uses a local Notion token.

Install only if you want an agent to read and modify Notion pages or databases you explicitly share with the Notion integration. Use a dedicated Notion integration, share the minimum databases needed, keep NOTION_TOKEN out of source control with restrictive local permissions, and review automation before it changes business, CRM, project, or customer records.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill documentation clearly relies on environment-based secret handling (`NOTION_TOKEN`) and command execution, but no explicit permission declaration is present. This creates a transparency and policy gap: an agent or reviewer may underestimate that the skill consumes credentials and performs external API actions, increasing the chance of unsafe use or overbroad deployment.

Description-Behavior Mismatch

Medium

• Confidence: 82% confidence
• Finding: The documentation says the integration only works on explicitly shared Notion pages/databases, but later introduces webhook-driven inbound sync that can update local memory files. That expands the data flow and trust boundary beyond simple user-initiated page access, which can mislead operators about what external changes may enter the local system.

Intent-Code Divergence

Low

• Confidence: 71% confidence
• Finding: The claim that the integration cannot access private teamspaces or other users' private pages is framed too broadly when later sections describe webhook processing of Notion changes into local memory. Even if direct API access remains scoped, the documentation understates the broader exposure surface created by inbound events and secondary storage.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The README repeatedly promotes creating, updating, and appending content in a live Notion workspace, but it does not clearly warn users that these are destructive or state-changing operations against production data. In an agent skill context, this increases the chance that users allow autonomous writes without understanding that mistakes, prompt injection, or bad automation can modify or corrupt real workspace content.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The skill documents write-capable actions such as creating entries, updating pages, and appending body content without an explicit warning that these operations modify user data. In an agent setting, that omission can lead to unintended changes, especially if commands are generated or executed automatically from user prompts.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: When `query-database --numbered` is used, the tool writes a mapping of entry numbers to real Notion page IDs into a predictable temp file (`notion-entry-mapping.json`) without warning the user or restricting file permissions. On shared or multi-user systems, this can unintentionally persist workspace metadata and expose internal page identifiers to other local processes or users.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: This CLI exposes multiple state-changing Notion operations such as add-entry, update-page, and append-blocks without any confirmation, dry-run mode, or prominent warning to the user. In an agent or automation context, this increases the chance of accidental or unauthorized content modification because a single command invocation can immediately alter remote workspace data.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The README instructs users to share Notion databases with the integration and later store a Notion token in a local env file, but it gives no warning about least-privilege sharing, token sensitivity, or avoiding broad workspace exposure. In an integration skill context, this can lead users to over-share databases or mishandle credentials, increasing the chance of unauthorized data access if the agent, host, or environment is compromised.

Credential Access

High

• Category: Privilege Escalation

Content

# Check for NOTION_TOKEN
if [ -z "$NOTION_TOKEN" ]; then
    if [ -f "$HOME/.openclaw/.env" ]; then
        export $(cat "$HOME/.openclaw/.env" | grep -v '#' | xargs)
    fi
fi

• Confidence: 93% confidence
• Finding: .env"

Credential Access

High

• Category: Privilege Escalation

Content

# Check for NOTION_TOKEN
if [ -z "$NOTION_TOKEN" ]; then
    if [ -f "$HOME/.openclaw/.env" ]; then
        export $(cat "$HOME/.openclaw/.env" | grep -v '#' | xargs)
    fi
fi

• Confidence: 93% confidence
• Finding: .env"

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.