ClawHub
Back to skill

Security audit

Notion API Tools

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward Notion API command-line skill, but it can read and change Notion workspace content if given a token with access.

Install only if you intend to let an agent use a Notion integration token. Use a dedicated least-privilege integration, share only the specific pages or databases needed, and carefully review any `create-page`, `append-blocks`, or `update-block` command because those can change workspace content.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The skill exposes block append and block update operations that extend beyond the stated metadata scope of search, querying data sources, and page creation. In an agent setting, this scope mismatch is dangerous because a caller may grant or invoke the skill expecting read/create behavior, while the implementation can also modify existing Notion content and therefore alter records or documents unexpectedly.

Intent-Code Divergence

Medium
Confidence
90% confidence
Finding
The top-of-file description presents the tool as a minimal CLI centered on search, query, and page creation, but the code also supports block retrieval and mutation. Misleading capability documentation is a security issue for agentic tooling because it undermines informed consent, code review, and policy decisions about whether the tool should be allowed to run with write access.

Missing User Warnings

Medium
Confidence
83% confidence
Finding
The skill instructs users to provide a Notion integration token and use commands that search, query databases, and create pages against the external Notion API, but it does not clearly disclose that workspace content and metadata will be transmitted to a third-party service. This omission can lead users to expose sensitive internal information without informed consent, especially in environments where agents may act on enterprise data.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
scripts/notion-api.mjs:18