Security audit

Notion技能

Security checks across malware telemetry and agentic risk

Overview

This Notion skill is mostly a documented API helper, but it asks for and describes command execution and broad file handling beyond its Notion purpose.

Install only if you are comfortable giving the agent access to a Notion integration token and letting it modify Notion pages or databases. Before using it, keep the Notion integration shared only with the exact pages/databases needed, confirm any update or delete request, and avoid letting the skill run arbitrary shell commands or process broad local file paths.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The skill is presented as a Notion API integration, but its manifest grants `exec`, `read`, and `write`, which are broader than necessary for page/database CRUD. Excess capabilities increase the blast radius if the skill is invoked unexpectedly or influenced by untrusted input, enabling local command execution and filesystem access unrelated to Notion operations.

Intent-Code Divergence

Medium

Confidence: 79% confidence
Finding: The documentation states the skill does not directly support file upload, yet elsewhere advertises file reading/writing and output-file handling. This inconsistency can mislead users or orchestration systems about what the skill may do, making overbroad file access seem acceptable and increasing the chance of unintended local data exposure or modification.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: Later sections explicitly claim command execution functionality even though the skill's stated purpose is interacting with the Notion API. In this context, unrelated command execution is dangerous because it invites use of shell actions outside the expected trust boundary, potentially leading to host compromise, secret exposure, or destructive local actions.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The invocation description is broad and generic, covering analysis, reporting, visualization, and workflow use cases that extend beyond a narrowly defined Notion skill. Overbroad triggering language can cause the agent to select this skill in unrelated contexts, which is more dangerous here because the skill also exposes filesystem access and command execution.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill documents destructive operations such as update/delete CRUD behavior without prominent warnings, confirmation requirements, or discussion of data-loss impact. In a Notion integration, this raises the risk of accidental or overly broad modification of user content, especially if the skill is auto-selected or driven by ambiguous instructions.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.