Sync Data Notion

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:47 AM UTC
• Version: 1.0.0

Overview

The skill describes a legitimate Notion sync workflow, but it can modify and export database data with under-scoped documentation and persistence behavior.

Review carefully before installing. Use a least-privilege Notion integration token, start with dry-run against a test database, avoid --auto-approve for production data, and only use reverse sync with destinations you explicitly trust because it can export Notion content outside the workspace.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (24)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

There is a clear description-behavior mismatch. The declared purpose centers on operational functionality for syncing user-provided CSV/JSON or external data into a Notion database, likely involving file parsing, Notion API interaction, and recurring sync workflows. The actual code chunk performs none of these tasks. Instead, it is an auto-generated compliance/test script for a skill repository, focused on markdown/frontmatter validation and basic repo quality checks. This is a materially different primary purpose and introduces undeclared capabilities unrelated to Notion syncing.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The README leaves the trigger condition as an unresolved placeholder, so the skill’s activation scope is undefined. In an agent ecosystem, ambiguous triggering can cause the skill to be invoked in unintended contexts, increasing the chance of inappropriate data sync actions or misuse with sensitive inputs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README advertises a write mode and requires an API key but provides no warning about destructive data modification, scope of writes, secret handling, or least-privilege practices. This can lead users or agents to perform live writes to Notion or expose credentials without understanding the operational and security risks.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Using a placeholder trigger condition leaves the activation criteria undefined, making it easier for an agent or user to invoke the skill in unintended contexts. For a skill that interfaces with an external data store, vague activation rules can expand the attack surface through accidental or overly broad triggering.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The README describes generic structured-output and read/write behavior that does not align with the declared purpose of syncing data to a Notion database. This mismatch can cause users or agents to invoke the skill under the wrong assumptions, increasing the chance of unintended data handling or unsafe execution paths when external systems are involved.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The usage examples document generic read/write modes instead of explicit Notion sync operations, which is particularly risky for a skill that can modify an external database. Ambiguous commands may lead operators to run write-capable actions without understanding the target, scope, or consequences, increasing the likelihood of accidental data corruption or unauthorized updates.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Documenting a write mode without any warning about modifying external data is unsafe because users may not realize the command can change a live Notion database. In the context of a synchronization skill, absent warnings and safeguards increase the risk of accidental overwrites, destructive updates, or propagation of malformed source data.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The activation condition for recurring syncs is broad and lacks precise invocation boundaries, which can cause over-triggering of a skill that reads external data, writes to Notion, and may perform repeated synchronization. In agentic settings, overly broad triggers increase the chance of unintended data movement or modification without sufficiently specific user intent.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest frames the skill as syncing data into Notion, but the body adds a reverse export mode that can write data from Notion to external targets. This scope expansion is dangerous because users or orchestrators may invoke the skill expecting inbound sync only, while the skill can also exfiltrate workspace data to CSV, JSON, or REST endpoints.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

L037-L039 states dry-run mode makes no API calls that modify data. But later execution guidance in L146-L153 assumes writes have occurred and instructs retrying when records are missing after write, without distinguishing dry-run behavior; this creates an active contradiction in the documented intent and operational flow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The reverse-sync feature can write Notion data to external systems, but the description does not prominently warn that this may overwrite or otherwise modify destination data. That omission matters because the capability changes the skill from a simple importer into a potential data-export/exfiltration and downstream-integrity risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

2. Retrieve Notion database schema

text

GET https://api.notion.com/v1/databases/{database_id}
Authorization: Bearer {NOTION_API_KEY}
Notion-Version: 2022-06-28

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 106)May include surrounding context.

2. Retrieve Notion database schema

text

GET https://api.notion.com/v1/databases/{database_id}
Authorization: Bearer {NOTION_API_KEY}
Notion-Version: 2022-06-28

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 119)May include surrounding context.

2. Retrieve Notion database schema

text

GET https://api.notion.com/v1/databases/{database_id}
Authorization: Bearer {NOTION_API_KEY}
Notion-Version: 2022-06-28

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 128)May include surrounding context.

2. Retrieve Notion database schema

text

GET https://api.notion.com/v1/databases/{database_id}
Authorization: Bearer {NOTION_API_KEY}
Notion-Version: 2022-06-28

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 150)May include surrounding context.

2. Retrieve Notion database schema

text

GET https://api.notion.com/v1/databases/{database_id}
Authorization: Bearer {NOTION_API_KEY}
Notion-Version: 2022-06-28

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 83% confidence

Finding

The skill stores last successful sync timestamps in ~/.sync_notion_last_run/{database_id}.json, creating cross-session persistent state tied to a database identifier. While not malicious, this can leak operational metadata across runs or users on shared environments and can influence future sync behavior in ways the current user may not expect.

Content

Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.

text

Parse `properties` to build a schema map:
- `title` → write via `title` array (required)
- `rich_text` → write via `rich_text` array of text objects
- `number` → write via `number` (must be float or null, not string)
- `checkbox` → write via `boolean`

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 88% confidence

Finding

The explicit mention of --auto-approve indicates the skill permits autonomous execution of production-affecting actions without per-run confirmation. This increases the blast radius of prompt mistakes, orchestration bugs, or ambiguous user requests.

Content

Scanner excerpt · SKILL.md (reported line 179)May include surrounding context.

md

- Do not skip records silently — every skip must be reported with a reason in the summary
- Do not perform full sync without a dry-run option — always offer `--dry-run` to preview changes
- Do not overwrite existing records unless the field values have actually changed (compare all fields)
- Do not sync to a production Notion database without confirming with the user first (unless `--auto-approve` is set)
- Do not assume all Notion property types are writable — `formula`, `relation`, `rollup`, `file`, `verified` are read-only in Notion API

### Do

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 88% confidence

Finding

The explicit mention of --auto-approve indicates the skill permits autonomous execution of production-affecting actions without per-run confirmation. This increases the blast radius of prompt mistakes, orchestration bugs, or ambiguous user requests.

Content

Scanner excerpt · SKILL.md (reported line 179)May include surrounding context.

md

- Do not skip records silently — every skip must be reported with a reason in the summary
- Do not perform full sync without a dry-run option — always offer `--dry-run` to preview changes
- Do not overwrite existing records unless the field values have actually changed (compare all fields)
- Do not sync to a production Notion database without confirming with the user first (unless `--auto-approve` is set)
- Do not assume all Notion property types are writable — `formula`, `relation`, `rollup`, `file`, `verified` are read-only in Notion API

### Do

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The test explicitly requires a file named README_zh.md to exist, which imposes a Chinese-language documentation requirement. This is a natural-language locale constraint, and the file does not indicate that language choice is optional or justified by a region-specific purpose.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The instruction 'Keep SKILL.md body in English' imposes a specific language requirement in natural-language guidance. Under the policy, forcing a language without user opt-in is a reportable locale/language policy violation unless clearly justified, and no justification is provided here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This line explicitly requires 'SKILL.md body must be in English; reference docs in English,' which is a natural-language policy constraint. The file does not provide an opt-in choice or a documented, region-specific justification for enforcing English-only documentation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The manifest describes syncing data into a Notion database, which implies create/update behavior, but L038 says preview mode includes 'deleted records,' suggesting the sync logic may also detect or propagate deletions. That is a broader operational model than a straightforward import/sync and is not reflected in the manifest description.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.