ClawHub
Back to skill

Security audit

solid-notion

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent guide for using a Notion CLI, with real but disclosed risks around installing a third-party CLI, storing a Notion token, and changing Notion pages.

Install only if you trust the solid-notion npm package and the Notion integration permissions you grant. Prefer stdin for tokens, avoid putting tokens in command lines or logs, share only the necessary Notion pages with the integration, and review local diffs or history before commands that write, submit, restore, or overwrite pulled files.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:15
Finding

Unpinned Global Installation of an Unverified Third-Party CLI

Content
View full analysis
Remediation
View remediation
``` 2. Prefer a project-local installation instead of a global installation, and invoke it through a controlled project script. 3. Commit a lockfile and verify package integrity and registry provenance before installation. 4. Publish or include the CLI source used by the Skill so its network, filesystem, and credential-handling behavior can be audited. 5. Use npm provenance signatures or an equivalent trusted release-verification mechanism. 6. Where operationally feasible, disable lifecycle scripts during installation and explicitly build only reviewed source. 7. Run the CLI in an isolated environment with access limited to the required Notion workspace and local directories. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:88
Finding

Notion Token Can Be Supplied Through a Process Command-Line Argument

Content
View full analysis
` | Visible in `ps` / shell history | | Stdin | `--token-stdin` | **Recommended** for agents | | JSON | `--input-json '{"token":"..."}'` | Useful for structured protocols | ``` ### Technical Analysis The Skill appropriately identifies that `--token ` is visible in process listings and shell history, and it recommends stdin for Agent workflows. However, it also documents an inline JSON alternative containing the token directly in a command-line argument. Supplying `--input-json '{"token":"..."}'` has substantially the same exposure characteristics as supplying `--token `. After a real token is substituted into the example, it may be captured by: - Process inspection tools while the command is running. - Shell history. - Terminal session recording. - Agent tool-call transcripts. - Command auditing and endpoint telemetry. - Wrapper scripts or CI logs that record command arguments. The issue concerns local credential exposure. The Skill's transmission of authenticated requests to the official Notion service is necessary for its declared page-management functionality, and the audited instructions do not direct tokens or page content to an unrelated network endpoint. ### Attack Path 1. A user or Agent selects the documented inline JSON authentication method. 2. The placeholder is replaced with a valid Notion integration token. 3. The complete token becomes part of the process argument vector and potentially the shell or Agent execution history. 4. A local user, monitoring service, log consumer, or attacker with access to retained execution records retrieves the token. 5. The attacker authenticates to the ...[truncated 861 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The markdown explains that rerunning pull page overwrites local output files, which can affect user data, but it does not provide a clear cautionary warning beyond the behavioral description. Under the markdown-specific warning rule, data-affecting behavior should be explicitly disclosed so users understand the modification risk before running the command.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The write command is documented as replacing the page content in Notion, which is a direct remote data-modifying action. Although restore mechanisms are described elsewhere, this section lacks a clear up-front warning that the command changes live Notion content and may overwrite existing page state.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 356)May include surrounding context.

Create a new page

bash
echo '{"title":"My New Page","notes":""}' | solid-notion new --parent <parent_id> -m "Create page" --json

Required flags:

Static analysis

No suspicious patterns detected.