ClawHub
Back to skill

Security audit

Notion命令行(专业版)

Security checks across malware telemetry and agentic risk

Overview

This Notion CLI skill is not clearly malicious, but it asks agents to use broad command-line authority for high-impact Notion operations while its scope and documentation are inconsistent.

Review before installing. Use only for explicit Notion tasks, verify the `notion-cli-tool` package and version independently, use least-privilege Notion integrations, avoid broad filters for deletes or moves, and require dry-run plus human confirmation before any batch delete, schema removal, page move, or cross-workspace operation.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
The documented return schema describes a generic scoring/audit report that does not match the advertised Notion CLI functionality, creating a material mismatch between claimed behavior and actual implementation. In an agent ecosystem, this can mislead orchestration layers or users into trusting outputs that are unrelated to the requested operation, increasing the chance of unsafe automation, bad decisions, or silent failure.

Intent-Code Divergence

High
Confidence
98% confidence
Finding
The file explicitly labels a snippet as the core implementation logic, but it only prints a static string and performs none of the claimed Notion operations. This is dangerous because it presents a non-functional or deceptive implementation as a ready automation tool, which can cause agents or operators to trust false execution status, skip verification, or build workflows around nonexistent behavior.

Vague Triggers

High
Confidence
88% confidence
Finding
The activation language is overly broad, framing the skill as applicable whenever efficiency, automation, batch processing, or workflow optimization are desired. In agent routing contexts, this can cause the skill to be invoked for a wide range of unrelated requests, expanding exposure to powerful exec-enabled behavior and increasing the risk of accidental destructive operations or misuse with sensitive data.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill documents destructive operations such as batch deletion and schema/property removal without strong, prominent warnings or mandatory safety procedures. Because the skill advertises bulk automation and exec support, this context makes accidental mass deletion or irreversible data loss substantially more dangerous than a normal read-only integration.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.