Security audit

Notion 工具包基础版

Security checks for vulnerabilities and agentic risk

Overview

This Notion skill is mostly coherent, but it under-discloses remote data flow and write authority while giving risky credential-handling instructions.

Review this skill carefully before installing. Use a least-privilege Notion integration, avoid running the broad environment-variable check, do not store live tokens in a project-relative plaintext file, and require explicit confirmation before any create or update action.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:175
Finding: Broad Environment Variable Enumeration May Expose Unrelated Credentials
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:162
Finding: Notion API Token Stored in a Project-Relative Plaintext File Without Permission Hardening
Content: View full analysis
./.config/notion/api_key ``` ### Technical Analysis The setup instructions direct users to place a Notion API token in a plaintext file under the current project directory. They do not establish owner-only permissions, verify the process umask, add the file to version-control exclusions, or use an operating-system secret store. When the placeholder is replaced with a live credential, the resulting file inherits permissions determined by the local environment. On permissively configured or shared systems, other local users or processes may be able to read it. Because the file is project-relative, it may also be accidentally committed, copied into build artifacts, synchronized by backup tools, or exposed through workspace-sharing mechanisms. The document later advises users not to commit API keys, but that warning does not technically protect the file created by this command. ### Attack Path 1. A user runs the documented setup commands from a project directory. 2. The user replaces `ntn_your_key_here` with a valid Notion integration token. 3. The token is written in plaintext to `./.config/notion/api_key`. 4. The file receives default permissions and is not automatically excluded from version control. 5. An unauthorized local user, workspace process, backup system, build artifact collector, or repository recipient obtains the file. 6. The exposed token is used to call the Notion API. 7. The attacker can read or modify resources that have been shared with the compromised Notion integration. ### Impact Assessment The attacker obtains the privileges assigned to the Notion integration token. Depending on the integration configuration and resources shared with it, this may permit searching workspace content, reading page ...[truncated 230 chars]
Remediation: View remediation
"$HOME/.config/notion/api_key" chmod 600 "$HOME/.config/notion/api_key" ``` Additional hardening measures: - Never include a live token directly in a shell command because it may be captured in shell history. - Add `.config/notion/api_key` and equivalent secret paths to `.gitignore`. - Add automated secret scanning to pre-commit and CI workflows. - Refuse to use credential files that are group-readable or world-readable. - Prevent credentials from entering build contexts, archives, caches, and diagnostic logs. - Restrict the Notion integration to the minimum necessary pages and capabilities. - Rotate the integration token immediately if the file has been committed, shared, backed up insecurely, or otherwise exposed. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The documentation makes a stronger contradiction by asserting all data remains local while describing API-driven operations that necessarily transmit content, metadata, and credentials to remote services. This can cause users or downstream agents to mishandle regulated or confidential data based on incorrect security assurances.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill advertises creation and update operations against Notion pages and databases but does not prominently warn that these actions modify live remote workspace data. Users may unknowingly authorize destructive or unintended changes, especially when the agent abstracts the underlying API calls.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Documenting a callback_url parameter without any warning about outbound data transmission creates a privacy and SSRF-style risk surface in agent workflows. If the agent posts results to arbitrary URLs, sensitive content, metadata, or tokens could be exfiltrated to attacker-controlled endpoints.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger condition is overly broad, suggesting activation for generic data analysis, reporting, insights, and visualization needs rather than tightly scoped Notion tasks. In an agentic environment, ambiguous triggers increase the chance the skill is invoked unexpectedly and performs networked reads or writes on remote workspace data.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill claims data is stored locally and not uploaded, yet the same document instructs the agent to call the external Notion API. This is a trust and privacy transparency failure: users may disclose sensitive workspace content under a false assumption that no remote transmission occurs.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The manifest fields and operational instructions are presented entirely in Chinese, but the file does not indicate that the skill is region-specific or that users may opt into this language. That can create a language-policy issue if skills are expected to avoid forcing a specific language without user choice.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.