Security audit

Notion命令行(专业版)

Security checks for vulnerabilities and agentic risk

Overview

This Notion CLI skill is not clearly malicious, but it asks agents to use broad command-line authority for high-impact Notion operations while its scope and documentation are inconsistent.

Review before installing. Use only for explicit Notion tasks, verify the `notion-cli-tool` package and version independently, use least-privilege Notion integrations, avoid broad filters for deletes or moves, and require dry-run plus human confirmation before any batch delete, schema removal, page move, or cross-workspace operation.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documented return schema describes a generic scoring/audit report that does not match the advertised Notion CLI functionality, creating a material mismatch between claimed behavior and actual implementation. In an agent ecosystem, this can mislead orchestration layers or users into trusting outputs that are unrelated to the requested operation, increasing the chance of unsafe automation, bad decisions, or silent failure.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The file explicitly labels a snippet as the core implementation logic, but it only prints a static string and performs none of the claimed Notion operations. This is dangerous because it presents a non-functional or deceptive implementation as a ready automation tool, which can cause agents or operators to trust false execution status, skip verification, or build workflows around nonexistent behavior.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The activation language is overly broad, framing the skill as applicable whenever efficiency, automation, batch processing, or workflow optimization are desired. In agent routing contexts, this can cause the skill to be invoked for a wide range of unrelated requests, expanding exposure to powerful exec-enabled behavior and increasing the risk of accidental destructive operations or misuse with sensitive data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill documents destructive operations such as batch deletion and schema/property removal without strong, prominent warnings or mandatory safety procedures. Because the skill advertises bulk automation and exec support, this context makes accidental mass deletion or irreversible data loss substantially more dangerous than a normal read-only integration.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.