ClawHub
Back to skill

Security audit

tool-save-to-notion

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it advertises: it fetches a user-provided tool link and saves structured details to a Notion database, though users should avoid private or internal links.

Install only if you want the agent to save tool links into the specified Notion database. Use a Notion integration token limited to that database, confirm the database ID is yours or intentionally shared, and do not use the skill for private, localhost, internal-network, credential-bearing, or confidential URLs.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Tainted flow: 'req' from os.environ.get (line 172, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
url,
            headers={'User-Agent': 'Mozilla/5.0 (compatible; NotionTool/1.0)'}
        )
        with urllib.request.urlopen(req, timeout=10) as response:
            html = response.read().decode('utf-8', errors='ignore')

        # Parse meta tags
Confidence
92% confidence
Finding
The script performs a network request to a user-supplied URL in order to scrape metadata for a cover image, with no validation of scheme, host, or destination. This creates an SSRF primitive that can be abused to access internal services, cloud metadata endpoints, or other restricted network resources from the environment where the skill runs.

Vague Triggers

Medium
Confidence
94% confidence
Finding
The trigger definition says to use the skill whenever the user provides ANY tool URL and wants to save it, which is broad enough to cause automatic invocation with minimal confirmation. In context, this can lead to unintended external fetching and persistent storage in Notion for URLs the user may only be discussing, increasing privacy and consent risk.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The instruction to 'immediately use this skill' for a wide set of link types is ambiguous and encourages action without clear boundaries or opt-in. Because the skill performs WebFetch and writes to a third-party service, this immediacy makes accidental data handling more likely and raises the risk of saving content the user did not intend to persist.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill explains extraction and saving behavior but does not clearly warn the user that their provided URL and derived metadata will be transmitted to external services and stored persistently in Notion. This is a real consent and privacy issue, especially when URLs may contain sensitive query parameters, internal resource locations, or confidential product pages.

Static analysis

No suspicious patterns detected.