ClawHub
Back to skill

Security audit

Notion 工具包基础版

Security checks across malware telemetry and agentic risk

Overview

This Notion automation skill can read and modify workspace content, but its privacy and scoping instructions are too unclear for automatic approval.

Install only if you are comfortable giving the agent a Notion integration token and letting it read or modify connected Notion pages/databases. Use a least-privilege Notion integration, connect only the pages you intend to manage, confirm every create/update action before execution, avoid callback_url unless it is your trusted endpoint, and treat the local-only privacy claim as inaccurate for API-backed operations.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Intent-Code Divergence

High
Confidence
98% confidence
Finding
The document claims that all FREE-version data is stored locally and never uploaded to the cloud, yet the same skill clearly instructs the agent to call the external Notion API. This is a material misrepresentation of data flows that can mislead users into sharing sensitive workspace content or credentials under false privacy assumptions.

Vague Triggers

Medium
Confidence
82% confidence
Finding
An overly broad trigger condition increases the chance the agent will invoke this skill for unrelated tasks, potentially causing unintended access to Notion content or external API usage. In an agentic environment with exec and read capabilities, accidental invocation can expose data or perform actions the user did not specifically intend.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill advertises creation and update operations against Notion content but does not prominently warn that these actions can modify or overwrite user data. Without clear write-scope warnings and confirmation requirements, users may trigger destructive or irreversible changes unintentionally.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill supports callback URLs and external API interactions but does not adequately disclose that user data, query contents, results, or metadata may be sent to third-party services. This omission can lead to inadvertent data exfiltration, especially if users assume the skill is local-only based on other claims in the document.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.