Security audit
Security checks for vulnerabilities and agentic risk
This Notion CLI is mostly purpose-aligned, but it includes under-documented commands that can modify Notion blocks immediately.
Install only if you are comfortable giving the agent a Notion integration token that can read or modify whatever pages and databases are shared with that integration. Review the block append and update commands before use, and prefer a limited Notion integration or test workspace because mutations happen immediately.
The skill exposes capabilities requiring environment access and network access, but the manifest does not declare any tool scope or allowed-tools constraints. This weakens reviewability and enforcement, making it easier for an agent to invoke broader-than-expected capabilities when handling a sensitive Notion token and making outbound API calls.
The skill advertises a create-page command that writes to Notion, but it does not clearly warn users that running it will modify remote user data. In agentic contexts, missing mutation warnings can cause unintended writes, surprise side effects, or misuse of an authorized integration token against production workspaces.
The top-of-file documentation says the CLI is for search, query data_sources, create page, and also block retrieval/list-append editing. However, the implemented commands additionally include update-block, which is a broader block modification capability than the documented 'append block children' editing scope. This is an active mismatch between the file's stated intent and implemented behavior.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
* Minimal Notion API CLI (no deps) for:
* - search
* - query data_sources
* - create page
* - retrieve blocks + list/append block children (for simple page editing)
*
* Auth:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
const query = args._.join(' ');
if (!query) die('usage: search <query> [--page-size N]');
const page_size = args['page-size'] ? Number(args['page-size']) : 10;
const out = await notionFetch('https://api.notion.com/v1/search', {
method: 'POST',
body: { query, page_size }
});
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
const query = args._.join(' ');
if (!query) die('usage: search <query> [--page-size N]');
const page_size = args['page-size'] ? Number(args['page-size']) : 10;
const out = await notionFetch('https://api.notion.com/v1/search', {
method: 'POST',
body: { query, page_size }
});
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
const query = args._.join(' ');
if (!query) die('usage: search <query> [--page-size N]');
const page_size = args['page-size'] ? Number(args['page-size']) : 10;
const out = await notionFetch('https://api.notion.com/v1/search', {
method: 'POST',
body: { query, page_size }
});
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
const query = args._.join(' ');
if (!query) die('usage: search <query> [--page-size N]');
const page_size = args['page-size'] ? Number(args['page-size']) : 10;
const out = await notionFetch('https://api.notion.com/v1/search', {
method: 'POST',
body: { query, page_size }
});
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
const query = args._.join(' ');
if (!query) die('usage: search <query> [--page-size N]');
const page_size = args['page-size'] ? Number(args['page-size']) : 10;
const out = await notionFetch('https://api.notion.com/v1/search', {
method: 'POST',
body: { query, page_size }
});
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
const query = args._.join(' ');
if (!query) die('usage: search <query> [--page-size N]');
const page_size = args['page-size'] ? Number(args['page-size']) : 10;
const out = await notionFetch('https://api.notion.com/v1/search', {
method: 'POST',
body: { query, page_size }
});
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
const query = args._.join(' ');
if (!query) die('usage: search <query> [--page-size N]');
const page_size = args['page-size'] ? Number(args['page-size']) : 10;
const out = await notionFetch('https://api.notion.com/v1/search', {
method: 'POST',
body: { query, page_size }
});
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
const query = args._.join(' ');
if (!query) die('usage: search <query> [--page-size N]');
const page_size = args['page-size'] ? Number(args['page-size']) : 10;
const out = await notionFetch('https://api.notion.com/v1/search', {
method: 'POST',
body: { query, page_size }
});
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
const query = args._.join(' ');
if (!query) die('usage: search <query> [--page-size N]');
const page_size = args['page-size'] ? Number(args['page-size']) : 10;
const out = await notionFetch('https://api.notion.com/v1/search', {
method: 'POST',
body: { query, page_size }
});
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
}
};
const out = await notionFetch('https://api.notion.com/v1/pages', { method: 'POST', body: payload });
console.log(JSON.stringify(out, null, 2));
}
The manifest describes the skill as a generic Notion API CLI for search, querying data sources/databases, and creating pages. This file also exposes retrieve-block, block-children, append-blocks, and update-block commands, including write-capable page/block editing operations that are not reflected in the manifest description.
The tool exposes write operations that can modify Notion content immediately via append and update calls, with no confirmation prompt, dry-run mode, or safety interlock. In an agentic context, this increases the risk of accidental or unauthorized workspace modification if the skill is invoked with untrusted parameters or by mistake.
Detected: suspicious.env_credential_access