T09 · Insecure Skill Coding Practices
- Location
SKILL.md:18- Finding
Notion API Key Stored Without Restrictive File Permissions
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 18–19 and line 30
Vulnerability Type: Plaintext credential storage with insufficient permission hardening
Risk Level: MediumVulnerable Code
bash mkdir -p ~/.config/notion echo "ntn_your_key_here" > ~/.config/notion/api_keyThe credential is subsequently loaded from that plaintext file:
bash NOTION_KEY=$(cat ~/.config/notion/api_key)Technical Analysis
The setup instructions store a Notion integration API key in a plaintext file but do not explicitly restrict permissions on either the containing directory or the credential file. With a common
umaskof022, the directory may be created with mode0755and the file with mode0644. On a multi-user system, this can allow other local users or processes operating under different accounts to read the token.The example also encourages entering the real token directly as an argument to
echo. Depending on shell configuration, that command and its token may be retained in shell history. The token is then used as a bearer credential, so possession is sufficient for API authentication; no additional proof of identity is required.Attack Path
- A user follows the documented setup instructions and substitutes a valid Notion integration token in the
echocommand. - The shell may retain the command, including the token, in its history.
- The credential file is created using default permissions rather than explicit owner-only permissions.
- Another local user or compromised process reads
~/.config/notion/api_keyor accessible shell-history data. - The attacker submits requests to
https://api.notion.comwithAuthorization: Bearer <stolen-token>. - The attacker reads or modifies Notion resources available to that integration.
Impact Assessment
An attacker who obtains the token can impersonate the Notion integration. The exact scope is bounded by the integration's Notion capabilities and the p ...[truncated 533 chars]
- A user follows the documented setup instructions and substitutes a valid Notion integration token in the
- Remediation
View remediation
Remediation Suggestions
Create the configuration directory and credential file with explicit owner-only permissions. Read the token interactively so it is not embedded directly in the demonstrated shell command:
bash install -d -m 700 ~/.config/notion read -rsp "Notion API key: " NOTION_KEY echo install -m 600 /dev/null ~/.config/notion/api_key printf '%s\n' "$NOTION_KEY" > ~/.config/notion/api_key unset NOTION_KEYAdditional hardening measures:
- Document that the file must remain mode
0600and its directory mode0700. - Prefer an operating-system credential manager or secrets manager instead of a plaintext file where supported.
- Warn users not to place real API keys directly in shell command arguments or committed configuration files.
- Configure the Notion integration with only the capabilities and workspace resources required for its intended tasks.
- Rotate the token immediately if it may have entered shell history or been stored with broadly readable permissions.
- Periodically review the pages and databases shared with the integration and revoke unnecessary access.
- Document that the file must remain mode