Security audit

Notion命令行(免费版)

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a real Notion CLI helper, but it uses sensitive Notion credentials and workspace mutation authority with an overly broad trigger and an unpinned global npm install.

Review before installing. Use this only for explicit Notion automation, pin and verify the npm package before installation, avoid sudo/admin shells, prefer environment or prompt-based token handling over command-line token arguments, grant the Notion integration the minimum permissions, and confirm any create/update/delete/comment/export action before running it.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

Location: SKILL.md:173
Finding: Unpinned Global Installation of an Unaudited Third-Party Package
Content: View full analysis
Remediation: View remediation
npx notion ``` 4. Disable npm lifecycle scripts where compatible. If lifecycle scripts are required, document and audit every script before installation. 5. Link to an official, verifiable source repository and associate the reviewed package version with a signed source tag or release artifact. 6. Run the CLI as an unprivileged user and explicitly warn users not to invoke global package installation through `sudo` or an administrator shell. 7. Review direct and transitive dependencies with package provenance verification, vulnerability scanning, and reproducible release controls. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:104
Finding: Notion API Token Exposed Through Process Command-Line Arguments
Content: View full analysis
`. 3. Shell expansion places the pla ...[truncated 1341 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger condition is overly broad: '需要项目管理、任务规划、进度跟踪、团队协作时使用' matches many ordinary workplace requests and can cause the skill to activate in contexts far beyond explicit Notion CLI operations. Because this skill has exec/write capabilities and performs external service actions against Notion, accidental invocation can lead to unintended data reads, updates, comments, or exports in a user's workspace.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.