Security audit

GitHub Stars Export

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its stated GitHub-to-Notion sync purpose, but it needs Review because it can archive Notion data without confirmation and disables TLS checks while using the Notion token.

Install only if you are comfortable giving it GitHub CLI access and a Notion integration token. Use a Notion integration limited to a dedicated page or database, pass an explicit parent ID, review or fix the script before use, remove verify=False, and avoid rerunning sync against valuable databases until it has confirmation and dry-run safeguards.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/sync_stars_to_notion_db.py:91
Finding: TLS Certificate Verification Is Disabled for Authenticated Notion API Requests
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/sync_stars_to_notion_db.py:97
Finding: Existing Notion Records Are Archived Before Input Is Validated
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/sync_stars_to_notion_db.py:18
Finding: Opaque Hardcoded Notion Parent Page Is Used as the Default Data Destination
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: requirements.txt:1
Finding: Python Dependency Is Not Version-Pinned
Content: View full analysis
Remediation: View remediation
\ --hash=sha256: ``` 3. Install with hash enforcement: ```bash pip install --require-hashes -r requirements.txt ``` 4. Use automated dependency scanning and update pinned versions through reviewed changes. 5. Install dependencies in an isolated virtual environment rather than into the system Python environment. 6. Use a trusted package index and retain installation provenance for released Skill versions. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (31)

Tainted flow: 'HEADERS' from os.environ.get (line 20, credential/environment) → requests.post (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/sync_stars_to_notion_db.py (reported line 91)May include surrounding context.
python
"category": {"multi_select": {}} } } response = requests.post(url, headers=HEADERS, json=payload, verify=False) if response.status_code != 200: print(f"Error creating database: {response.text}") sys.exit(1)

Tainted flow: 'HEADERS' from os.environ.get (line 20, credential/environment) → requests.post (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/sync_stars_to_notion_db.py (reported line 157)May include surrounding context.
python
"category": {"multi_select": {}} } } response = requests.post(url, headers=HEADERS, json=payload, verify=False) if response.status_code != 200: print(f"Error creating database: {response.text}") sys.exit(1)

Tainted flow: 'HEADERS' from os.environ.get (line 20, credential/environment) → requests.post (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/sync_stars_to_notion_db.py (reported line 111)May include surrounding context.
python
if next_cursor: payload["start_cursor"] = next_cursor response = requests.post(query_url, headers=HEADERS, json=payload, verify=False) if response.status_code != 200: print(f"Error querying database for clearing: {response.text}") break

Tainted flow: 'HEADERS' from os.environ.get (line 20, credential/environment) → requests.patch (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/sync_stars_to_notion_db.py (reported line 122)May include surrounding context.
python
for page in pages: page_id = page["id"] patch_url = f"https://api.notion.com/v1/pages/{page_id}" requests.patch(patch_url, headers=HEADERS, json={"archived": True}, verify=False) count += 1 has_more = data.get("has_more", False)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: If the associated sync workflow archives all existing Notion pages, uses a hardcoded default parent page ID, and persists mappings locally without clearly disclosing this in the skill, users may unintentionally destroy or alter remote data. In a skill that advertises a simple export-and-sync workflow, undisclosed destructive remote modification materially increases risk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: If the associated sync workflow archives all existing Notion pages, uses a hardcoded default parent page ID, and persists mappings locally without clearly disclosing this in the skill, users may unintentionally destroy or alter remote data. In a skill that advertises a simple export-and-sync workflow, undisclosed destructive remote modification materially increases risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The documentation explicitly states that a default fallback Notion API key is hardcoded in the script if the environment variable is unset. Embedded credentials are dangerous because they can be extracted from source, reused by unauthorized parties, and may grant direct access to Notion content or permit unauthorized modifications.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: When an existing database mapping is found, the script automatically archives all existing pages before repopulating the database, with no confirmation, dry-run mode, or backup step. In an automation skill, this creates a substantial integrity risk because a wrong database ID, stale config entry, or operator mistake can silently destroy user content at scale.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README instructs users to sync GitHub star data into Notion and notes a local state file, but it does not clearly warn that repository metadata will be transmitted to a third-party service or that persistent local files will be created. This can lead users to disclose potentially sensitive repository interests, names, URLs, and categorization data without informed consent, especially if starred repositories include private, internal, or sensitive topics.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill declares no explicit tool scope even though it instructs use of environment variables, local file reads/writes, and networked services (GitHub and Notion). Missing scope/permission declarations weakens user awareness and policy enforcement, increasing the chance the skill is run with broader access than intended.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill omits a clear warning that syncing sends repository metadata to Notion and modifies third-party remote data. This is dangerous because users may expose private interest patterns, repository metadata, or organizational information to an external service without informed consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest explicitly defines a local export operation and a sync operation to an external Notion service, but it provides no user-facing warning, consent gate, or data-handling notice. Even if the data is only GitHub stars metadata, the skill writes locally and transmits externally, which can surprise users, expose private categorization data, or cause unintended disclosure if the source account or destination database is sensitive.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/export_stars.md (reported line 21)May include surrounding context.
md
- If not, run `gh auth login` and follow the prompts. 2. **[jq](https://jqlang.github.io/jq/)**: A lightweight and flexible command-line JSON processor. - Mac: `brew install jq` - Debian/Ubuntu: `sudo apt-get install jq` - Arch Linux: `sudo pacman -S jq` ## Usage

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/export_stars.md (reported line 22)May include surrounding context.
md
- If not, run `gh auth login` and follow the prompts. 2. **[jq](https://jqlang.github.io/jq/)**: A lightweight and flexible command-line JSON processor. - Mac: `brew install jq` - Debian/Ubuntu: `sudo apt-get install jq` - Arch Linux: `sudo pacman -S jq` ## Usage

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The docs mention a local '.notion_sync_config.json' state tracker but do not clearly warn that it stores the mapping between user-supplied database names and Notion database IDs. While not inherently secret, this local state can lead to unintended writes to the wrong database, confusion during reuse on shared systems, or accidental disclosure of workspace structure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The script reads the Notion API token from the environment and uses it in HTTP Authorization headers for multiple outbound requests, but there is no confirmation prompt or explicit user-facing warning that credentials will be used to create, query, archive, and insert data in Notion. While the script's purpose implies syncing to Notion, it does not clearly disclose credential use or remote data transmission in comments or runtime messaging.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/sync_stars_to_notion_db.py (reported line 77)May include surrounding context.
python
def create_database(db_name, parent_id): """Creates a new Notion database and returns its ID.""" url = "https://api.notion.com/v1/databases" payload = { "parent": {"type": "page_id", "page_id": parent_id}, "title": [

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/sync_stars_to_notion_db.py (reported line 100)May include surrounding context.
python
def create_database(db_name, parent_id): """Creates a new Notion database and returns its ID.""" url = "https://api.notion.com/v1/databases" payload = { "parent": {"type": "page_id", "page_id": parent_id}, "title": [

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/sync_stars_to_notion_db.py (reported line 121)May include surrounding context.
python
def create_database(db_name, parent_id): """Creates a new Notion database and returns its ID.""" url = "https://api.notion.com/v1/databases" payload = { "parent": {"type": "page_id", "page_id": parent_id}, "title": [

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/sync_stars_to_notion_db.py (reported line 132)May include surrounding context.
python
def create_database(db_name, parent_id): """Creates a new Notion database and returns its ID.""" url = "https://api.notion.com/v1/databases" payload = { "parent": {"type": "page_id", "page_id": parent_id}, "title": [

External Transmission

Medium

Category: Data Exfiltration
Confidence: 80% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/sync_stars_to_notion_db.py (reported line 91)May include surrounding context.
python
"category": {"multi_select": {}} } } response = requests.post(url, headers=HEADERS, json=payload, verify=False) if response.status_code != 200: print(f"Error creating database: {response.text}") sys.exit(1)

External Transmission

Medium

Category: Data Exfiltration
Confidence: 80% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/sync_stars_to_notion_db.py (reported line 157)May include surrounding context.
python
"category": {"multi_select": {}} } } response = requests.post(url, headers=HEADERS, json=payload, verify=False) if response.status_code != 200: print(f"Error creating database: {response.text}") sys.exit(1)

Unsafe Defaults

Medium

Category: Tool Misuse
Confidence: 99% confidence
Finding: The request disables TLS certificate verification with verify=False and globally suppresses related warnings. That allows a man-in-the-middle attacker on the network or a hostile proxy to intercept or modify traffic, including the Notion bearer token and database contents, undermining confidentiality and integrity.
Content: Scanner excerpt · scripts/sync_stars_to_notion_db.py (reported line 91)May include surrounding context.
python
"category": {"multi_select": {}} } } response = requests.post(url, headers=HEADERS, json=payload, verify=False) if response.status_code != 200: print(f"Error creating database: {response.text}") sys.exit(1)

External Transmission

Medium

Category: Data Exfiltration
Confidence: 80% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/sync_stars_to_notion_db.py (reported line 111)May include surrounding context.
python
if next_cursor: payload["start_cursor"] = next_cursor response = requests.post(query_url, headers=HEADERS, json=payload, verify=False) if response.status_code != 200: print(f"Error querying database for clearing: {response.text}") break

Unsafe Defaults

Medium

Category: Tool Misuse
Confidence: 99% confidence
Finding: Disabling certificate validation on database query requests permits interception and tampering with responses that drive subsequent archival actions. An attacker could manipulate queried results or steal the bearer token, potentially causing unauthorized data loss or account abuse.
Content: Scanner excerpt · scripts/sync_stars_to_notion_db.py (reported line 111)May include surrounding context.
python
if next_cursor: payload["start_cursor"] = next_cursor response = requests.post(query_url, headers=HEADERS, json=payload, verify=False) if response.status_code != 200: print(f"Error querying database for clearing: {response.text}") break

Static analysis

No suspicious patterns detected.