Security audit
Security checks for vulnerabilities and agentic risk
This Notion skill is mostly purpose-aligned, but it requests broad local command execution and supports real Notion changes without clear safeguards.
Review this skill carefully before installing. Use a Notion integration token with the minimum workspace access needed, avoid broad page/database sharing, and do not allow command execution or destructive Notion changes unless your agent runtime provides separate confirmation and scoping controls.
The skill asserts that command execution is limited to a whitelist, but the file only advertises generic exec capability and provides no actual enforcement mechanism. This creates a misleading security boundary: an agent or user may trust that shell actions are constrained when they are not, enabling arbitrary command execution if later prompts or wrappers route input into exec.
The declared toolset includes generic command execution even though the stated purpose is Notion page/database management via API. That unnecessarily expands the attack surface from scoped API operations to arbitrary local code execution, which could lead to host compromise, secret theft, filesystem tampering, or pivoting to other systems if the agent is induced to run commands.
The description says to use the skill for broad data analysis, report generation, statistical insight, and visualization tasks, which exceeds a narrowly defined Notion integration role. This can cause the skill to be invoked for unrelated requests, increasing chances that its powerful tools—including exec—are exposed in contexts where users did not intend local execution or Notion-side modifications.
The skill advertises delete capability for pages without a prominent warning, confirmation requirement, or safety guard around destructive actions. In an agent setting, ambiguous user requests or prompt injection could cause unintended content deletion or irreversible workspace changes, especially because Notion operations affect real user data.
No suspicious patterns detected.
