ClawHub
Back to skill

Security audit

Notion Api Toolkit Free

Security checks across malware telemetry and agentic risk

Overview

This Notion skill is mostly coherent, but it asks for powerful CLI-based read/write access while using overly broad triggers and unrelated local network diagnostics.

Review this before installing. Only use it for explicit Notion tasks, confirm every write target carefully, avoid granting broad workspace access, and do not run unrelated shell diagnostics unless you intentionally requested troubleshooting. Also verify the CLI package source before installing globally because the referenced npm package could not be confirmed in the public registry during this review.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
The skill is for Notion API integration, but its error-handling text instructs the agent to execute unrelated shell `ping` commands. That expands behavior beyond the declared scope and can normalize arbitrary local command execution, especially dangerous in agent environments where `exec` is enabled.

Context-Inappropriate Capability

Medium
Confidence
96% confidence
Finding
Introducing local network-diagnostic execution in a Notion skill is unjustified by the documented functionality and creates an unnecessary command-execution pathway. In an agent with `exec` access, even seemingly harmless commands broaden the attack surface and may be abused as a stepping stone to more dangerous shell actions.

Vague Triggers

Medium
Confidence
90% confidence
Finding
The trigger conditions are broad enough to activate this skill for generic API integration, interface docking, webhook configuration, or system connection tasks that may have nothing to do with Notion. Overbroad activation increases the chance an agent invokes a powerful skill with read/write/exec capabilities in the wrong context.

Vague Triggers

Medium
Confidence
91% confidence
Finding
The scope description relies on generic keywords such as integration tool, REST, developer, workspace, and quick access, which are likely to match unrelated user requests. This can cause unintended invocation and expose Notion-connected read/write/exec functionality in contexts where it is not appropriate.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.