Notion 页面管理基础版

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:35 AM UTC
• Version: 1.0.1

Overview

This Notion management skill appears purpose-aligned but needs Review because it can read and modify remote Notion data while making inconsistent privacy and credential-scope claims.

Review this carefully before installing. It is not clearly malicious, but it can use local exec commands and Notion credentials to read and modify remote workspace content. Only use it with a least-privilege Notion integration, avoid running the broad environment-variable check, and confirm every create/update/export action yourself.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:177

Finding

Overbroad Enumeration of Credential-Related Environment Variables

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 177–184
Vulnerability Type: Credential-related environment reconnaissance
Risk Level: Medium

Vulnerable Code

bash

# Verify whether environment variables are configured
echo "Configuration check:"
env | grep -E "API|KEY|TOKEN|SECRET" | sed "s/=.*/=***/"  # Linux/macOS
# Or PowerShell
# Get-ChildItem Env: | Where-Object {$_.Name -match "API|KEY|TOKEN"} | Format-Table

Technical Analysis

The Skill instructs the Agent to enumerate the process's entire environment and select variables whose names contain credential-related terms such as API, KEY, TOKEN, or SECRET. This is broader than necessary to validate Notion authentication and violates least-exposure principles.

The Unix pipeline masks values before displaying them, but it still reads every environment variable and reveals the names of unrelated credentials and integrations. Such names can disclose which cloud providers, APIs, deployment systems, or authentication mechanisms are present.

The commented PowerShell alternative is less safe because Format-Table may display both names and values of matching environment variables if a user or Agent executes it after removing the comment markers. The document already provides the narrower notion-cli auth status command, so generic environment enumeration is unnecessary.

No credential-value theft or external transmission is established by the reviewed file. The issue is limited to excessive local discovery and possible disclosure through Agent-visible output, terminal history, or execution logs.

Attack Path

1. A user asks an AI Agent to configure or verify the Skill.
2. The Agent follows the environment-validation instructions in SKILL.md.
3. The shell reads the entire process environment and filters credential-related entries.
4. Matching variable names—and potentially values if the PowerShell alternative is used—appea ...[truncated 844 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove generic env and Get-ChildItem Env: enumeration from the Skill.

2. Use the already documented, purpose-specific authentication check:

   bash

   notion-cli auth status
   

3. If a specific environment variable must be checked, test only the documented Notion variable without printing its value:

   bash

   if test -n "${NOTION_TOKEN:-}"; then
     echo "NOTION_TOKEN is configured"
   else
     echo "NOTION_TOKEN is not configured"
   fi
   

4. For PowerShell, use a Boolean existence check rather than formatting the environment entry:

   powershell

   if ([string]::IsNullOrEmpty($env:NOTION_TOKEN)) {
     Write-Output "NOTION_TOKEN is not configured"
   } else {
     Write-Output "NOTION_TOKEN is configured"
   }
   

5. Prevent credential-related environment inventory from being included in Agent responses, execution logs, cached results, or diagnostic bundles.

6. Explicitly instruct the Agent never to print authentication tokens or unrelated environment-variable names during configuration validation.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill claims that all FREE-version data is stored locally and not uploaded to the cloud, but the same file states that some features require network access to external APIs and OAuth connection to Notion. This is a materially misleading privacy/security statement that may cause users to expose workspace data under false assumptions about data locality and transmission.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The display name, summary, and the entire user-facing description are presented in Chinese, with no indication that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the policy, a fixed language without opt-in is a natural-language policy concern unless clearly justified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill advertises write-capable operations such as creating and updating pages and also declares exec capability, but it does not prominently warn users that actions may modify remote Notion data or invoke shell commands. In agent contexts, insufficient disclosure and confirmation around state-changing and command-executing behavior can lead to unintended data modification, destructive actions, or misuse of local execution privileges.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document presents contradictory security and capability claims: it says advanced OAuth/auth credential management is a PRO-only feature, while elsewhere instructing FREE users to authenticate with Notion and check auth status. This can mislead users and agents about whether credentials are in scope, what protections apply, and whether sensitive auth flows are expected, increasing the chance of unsafe handling of tokens or over-trusting the skill's security posture.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The trigger condition is overly broad and mismatched to the tool's stated Notion page/database scope, mentioning generic analytics, reporting, insights, and visualization needs. In an agentic environment, this can cause accidental invocation in unrelated contexts, increasing the chance of unintended page reads, writes, or external calls with user data.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.