ClawHub
Back to skill

Security audit

Notion Sync

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly transparent Notion tooling, but it needs Review because one batch update command can modify many Notion records more broadly than the docs imply.

Review before installing if your Notion workspace contains important shared or business data. Use a least-privilege Notion integration shared only with needed pages/databases, protect any token file, run batch updates with --dry-run first, always provide a narrow --filter, and avoid --allow-unsafe-paths unless you intentionally need files outside the current workspace.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Session Persistence

Medium
Category
Rogue Agent
Content
## Setup

1. Go to https://www.notion.so/my-integrations
2. Create a new integration (or use an existing one)
3. Copy the "Internal Integration Token"
4. Pass the token using one of these methods (priority order used by scripts):
Confidence
81% confidence
Finding
The skill instructs users to persist a long-lived Notion integration token in `~/.notion-token` and even auto-load it by default if present. Persistent credential storage increases exposure to local compromise, accidental reuse across projects, and unintended access by other tools or sessions running under the same account.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
const action = mode === 'write' ? 'write to' : 'read from';
    throw new Error(
      `Refusing to ${action} path outside current workspace: ${inputPath}. ` +
      'Use --allow-unsafe-paths to override intentionally.'
    );
  }
Confidence
84% confidence
Finding
The utility enforces a workspace boundary for file reads/writes but also provides a universal bypass via --allow-unsafe-paths. In an agent skill context, this is dangerous because any workflow or prompt-controlled invocation that can add CLI flags may turn a constrained file operation into arbitrary filesystem access, enabling exfiltration of sensitive files or writes outside the intended project directory.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.