soul-in-sapphire

• Outcome: Review
• Latest audit: Sep 7, 2026 · 9:28 AM UTC
• Version: 1.1.0

Overview

The skill is purpose-built for Notion-backed emotional memory, but it needs review because it persistently stores sensitive journal and self-state data and exposes broad Notion helper capabilities.

Install only if you intentionally want an agent to save emotional memory, journals, state snapshots, and recall candidates in Notion and local workspace files. Use a dedicated Notion integration shared only with the five intended databases, avoid the @latest install form when possible, disable ambient recall with SIS_AMBIENT_RECALL=0 if you do not want background staging, and do not place secrets or highly private third-party details in journal payloads.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:49
• Finding: Unpinned Third-Party Package Execution in Installation Instructions## Vulnerability Details **File Location**: `README.md:49-57` **Vulnerability Type**: Supply-chain risk from executing a mutable third-party package release **Risk Level**: Medium ### Vulnerable Code ```bash # notion-api-automation npx clawhub@latest install notion-api-automation pnpm dlx clawhub@latest install notion-api-automation ``` The same unsafe installation pattern is repeated at `README.md:149-156`: ```bash npx clawhub@latest install notion-api-automation ``` ```bash pnpm dlx clawhub@latest install notion-api-automation ``` ### Technical Analysis The documented commands download and execute the mutable `latest` release of the third-party `clawhub` package. No reviewed version or package integrity value is pinned. Consequently, the code executed by users can change after this Skill has been reviewed. This dependency is security-sensitive because it installs `notion-api-automation`, which is subsequently invoked by `scripts/notionctl_bridge.js` and operates in a process environment that may contain a Notion API credential. A malicious package release, compromised publisher account, registry compromise, or compromised transitive dependency could therefore execute arbitrary JavaScript during installation or package invocation. This finding is limited to the documented package installation mechanism. The project itself declares no runtime npm dependencies, and no evidence was found that the included scripts covertly retrieve or execute a remote payload. ### Attack Path 1. An attacker compromises the `clawhub` package, its publisher account, or a transitive dependency, or publishes a malicious future version under the same package channel. 2. A user follows the documented `npx clawhub@latest` or `pnpm dlx clawhub@latest` command. 3. The package manager resolves `latest` to the attacker-controlled release and downloads it. 4. Package lifecycle or runtime code executes with the invoking user’s OS privileges. 5. The malicious code can access files an ...[truncated 928 chars]
• Remediation: ## Remediation Suggestions 1. Replace `@latest` with an explicitly reviewed and immutable version: ```bash npx clawhub@<reviewed-version> install notion-api-automation pnpm dlx clawhub@<reviewed-version> install notion-api-automation ``` 2. Pin `notion-api-automation` to a reviewed version rather than relying on a mutable default release. 3. Record and verify package integrity metadata through a committed lockfile or equivalent checksum-based verification. 4. Document the expected package publisher, source repository, and reviewed release identifier so users can verify package provenance. 5. Review package lifecycle scripts and transitive dependencies before updating the pinned version. 6. Perform installation in a constrained environment without production credentials. Inject `NOTION_API_KEY` only when the reviewed runtime component is actually needed. 7. Apply the same changes to both duplicated installation sections at `README.md:49-57` and `README.md:149-156`.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (20)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence
• Finding: The skill clearly uses environment-provided credentials and networked access to Notion, but does not declare permissions or otherwise constrain those capabilities. That creates a transparency and policy-enforcement gap: a host may expose secrets or allow outbound access without the user realizing this skill persists and retrieves sensitive data remotely.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: The stated purpose sounds like memory recall and continuity support, but the skill operationally does much more: remote database writes, local artifact creation, schema/setup actions, and ambient recall staging/receipt tracking. This mismatch can mislead users and orchestrators into invoking a skill with broader persistence and infrastructure-modifying behavior than the description suggests, increasing the chance of unconsented data storage or unexpected side effects.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The skill is framed as handling subjective journaling, memory recall, and identity continuity, which are highly sensitive functions, yet this script sends that content to an external Notion database. That creates a clear data-boundary violation risk because intimate internal-state data may be exfiltrated to a third-party service without explicit disclosure or tight scoping.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The script requires a workspace-specific database ID and uses it to create remote pages, giving the skill a concrete exfiltration path into an external tenant. For a skill centered on journaling and identity continuity, that capability is sensitive and broad unless strongly justified, constrained, and transparently disclosed.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The exported httpJson wrapper exposes a generic pass-through to arbitrary Notion API paths and methods, enabling reads and writes well beyond a narrow journaling use case. In a skill focused on emotion-linked memory and self-state journaling, this materially expands accessible data and actions, increasing the risk of unauthorized workspace-wide access, exfiltration, or destructive modification if upstream prompts or tool invocations are abused.

Context-Inappropriate Capability

Medium

• Confidence: 83% confidence
• Finding: The code executes an external helper script and allows its location to be overridden via the NOTIONCTL_PATH environment variable. While execFileSync avoids shell injection, this still permits execution of an unexpected binary or script in environments where attackers can influence environment variables or deployment layout, expanding trust to code outside the reviewed skill.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The bridge exposes broad mutation primitives including database creation, data source patching, page creation, and page patch/archive operations. For a journaling and identity-continuity skill, this exceeds least privilege and allows modification of unrelated Notion structures if the tool is invoked with attacker-influenced parameters or mis-scoped credentials.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The README explicitly describes storing emotion-linked memory, mood, learning, and subjective journaling in Notion, but it does not provide a prominent user warning about the sensitivity of that data or the privacy implications of external persistence. Because the skill is designed to capture highly personal internal-state information, the lack of explicit consent and disclosure materially increases the risk of users exposing sensitive data unintentionally.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The automatic execution section recommends scheduled background recording of events, emotions, state, and daily journals, but it does not include a strong user-facing warning that ongoing persistence of personal data may happen without per-entry confirmation. Background collection of subjective and conversational data is particularly sensitive because users may not realize the scope or frequency of storage once automation is enabled.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The instructions direct writes to local workspace files and Notion-backed storage, including subjective state, journals, and memory records, without requiring a clear user-facing disclosure at the moment of persistence. Because the content includes emotional state and identity-related notes, silent persistence raises privacy and consent risks beyond ordinary note-taking.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script sends highly sensitive emotional and contextual data directly to Notion by calling createPage() with fields such as trigger, context, body_signal, need, coping, and linked event data, but it contains no consent gate, warning, minimization, or redaction step. In a skill explicitly designed for identity continuity and subjective journaling, this increases privacy risk substantially because intimate psychological data may be persisted to a third-party SaaS unexpectedly or more broadly than the user intended.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The script serializes a computed state snapshot into state_json and writes it to Notion, including longitudinal emotional profile data and 'imprints' that may encode persistent high-severity experiences over time. This is more sensitive than a transient event log because it creates durable inferred mental-state records that could expose patterns, vulnerabilities, and identity-linked history if the workspace is misconfigured, shared, or later accessed by others.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: Journal text and related metadata are sent to Notion with no user-facing warning at the point of transmission. Because the content may include emotional state, reflections, plans, and continuity-related material, silent network export materially increases privacy and trust risk.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script sends the user-provided query to a remote Notion data source and returns matching memory record content, but it contains no disclosure, consent, or trust-boundary indication for the operator. In this skill’s context—emotion-linked memory recall, subjective journaling, and identity continuity—the searched and returned data is likely highly sensitive, so silent transmission to a remote service meaningfully increases privacy and confidentiality risk.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: patchPage permits archiving any supplied page ID without any confirmation, policy check, or scope restriction. In a tool-accessible context, this creates a straightforward destructive path for accidental or adversarial data loss across Notion content reachable by the token.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The durable-memory path performs network-backed retrieval from Notion via queryDataSource/queryRecent and then uses the returned content to stage recall, but this file provides no user-facing notice, consent gate, or disclosure at the point of access. In a skill explicitly dealing with identity, journal, and emotional memory, silent remote retrieval increases privacy risk because highly sensitive content can be fetched and surfaced unexpectedly.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: When a candidate is found, the script writes staged recall data, including title/content and affect_context, to local JSON files under the state directory without any explicit warning to the user. Because the content can come from journals, state pages, dreams, and durable memories, this creates a local persistence channel for sensitive personal data that may outlive the immediate operation and be readable by other local processes or backup systems.

Ssd 3

Medium

• Confidence: 92% confidence
• Finding: The skill's stated purpose is to externalize conversation-adjacent memory, emotion, self-state, and subjective continuity into Notion, which creates a real risk of sensitive natural-language data leakage to an external service. Even if intended as a memory feature, storing intimate psychological context and reflective content outside the core system expands the confidentiality and misuse surface.

Ssd 3

Medium

• Confidence: 93% confidence
• Finding: The journal workflow explicitly instructs the system to summarize daily work, conversations, emotions, future plans, and world events into Notion, which semantically encourages ongoing disclosure of private interaction data. This is dangerous because conversation summaries often contain user secrets, sensitive relationships, health information, or other personal details that may be copied into a third-party platform without adequate filtering.

Ssd 3

Medium

• Confidence: 89% confidence
• Finding: The ambient recall design stages and later reuses memory artifacts from both the agent workspace and Notion, which increases the chance that previously stored sensitive data will resurface in later contexts where it is no longer appropriate. Reintroduction of old journal, dream, state, or memory content can expose private details unexpectedly, especially if the recalled content is shown or used without fresh relevance, consent, or filtering.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/notionctl_bridge.js:87