Security audit

Notion笔记工具

Security checks across malware telemetry and agentic risk

Overview

This Notion skill is mostly recognizable as a Notion automation guide, but it asks for broad command execution and mutation authority without clear safeguards.

Review this skill carefully before installing. Use it only with a least-privilege Notion integration token and avoid giving it shell execution unless the publisher adds a concrete, enforced command allowlist and clear confirmation steps for destructive Notion updates or deletes.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The skill declares `exec` capability and later documents command execution even though its stated purpose is Notion page/database management. That unnecessary expansion of privileges increases the attack surface substantially: a prompt intended for document automation could be steered into local shell execution, enabling data access, command injection chains, or environment secret exposure if the hosting agent honors the declared tools.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The file asserts that only whitelisted commands will be executed, but provides no implementation, policy artifact, or enforceable mechanism to back that claim. This creates a false sense of safety around a dangerous capability; in practice, an agent or integrator may permit broader command execution than users expect, making abuse of the advertised `exec` tool more likely and harder to detect.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The activation language is much broader than the skill’s actual Notion-focused purpose, including generic data analysis, reporting, statistics, and visualization scenarios. Overbroad routing increases the chance that the skill is invoked in contexts unrelated to Notion, which is especially risky here because the skill also advertises file access and command execution capabilities that exceed simple API usage.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill advertises update and delete operations on Notion content without clear warnings, confirmation requirements, or safeguards for destructive actions. In an agent setting, ambiguous prompts or misrouting could lead to unintended modification or deletion of user content, and the Notion context makes this concretely dangerous because the tool is positioned to act on real workspace data.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.