ClawHub
Back to skill

Security audit

Notion Manager

Security checks for vulnerabilities and agentic risk

Overview

This Notion skill is coherent, but it asks users to install an unpinned global npm package and store a Notion token in plaintext before using commands that can modify live Notion data.

Review this skill before installing. Pin and verify the npm package version if possible, consider installing it in an isolated environment instead of globally, use a minimally scoped Notion integration, share only the specific pages or databases needed, and store NOTION_TOKEN in a secure credential store or at least a chmod 600 file rather than a broadly readable plaintext file.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:14
Finding

Unpinned Global Installation of a Third-Party npm Package

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:14 and duplicated in README.md:9
Vulnerability Type: Unpinned third-party dependency and unclear package provenance
Risk Level: Medium

Vulnerable Code

SKILL.md:14:

bash
npm install -g @iansinnott/notion-cli

The same installation instruction appears in README.md:9.

Technical Analysis

The project instructs users to install the latest available version of @iansinnott/notion-cli globally. It does not pin an exact reviewed version, verify a package integrity hash, provide a lockfile, or recommend disabling npm lifecycle scripts.

A global npm installation can execute package lifecycle scripts with the privileges of the user running npm. Because no version is pinned, the effective code installed can change after this Skill has been reviewed. A compromised maintainer account, malicious newly published release, or package registry compromise could therefore introduce arbitrary executable behavior.

Package provenance is also unclear in the audited documentation. The installed npm package is scoped as @iansinnott/notion-cli, while the declared homepage and reference repository are https://github.com/litencatt/notion-cli. The documentation does not establish or verify that the npm scope and referenced repository are controlled by the same trusted publisher.

Attack Path

  1. An attacker compromises the npm publisher account, package release process, or another relevant supply-chain component.
  2. The attacker publishes a malicious version of @iansinnott/notion-cli.
  3. A user follows the Skill instructions and runs the unpinned global installation command.
  4. npm downloads the current malicious release and may execute its lifecycle scripts during installation.
  5. The malicious package executes with the user's privileges.
  6. It can access local files and environment variables available to the process, potentially including `NOTION_TOKEN ...[truncated 815 chars]
Remediation
View remediation

Remediation Suggestions

  • Pin the dependency to an exact reviewed version instead of installing the latest release:

    bash
    npm install -g @iansinnott/notion-cli@<reviewed-exact-version>

  • Verify and document the relationship between the npm publisher, package scope, and referenced GitHub repository.

  • Publish expected package integrity information and verify the downloaded artifact before installation.

  • Review the selected package version, including its dependencies and npm lifecycle scripts.

  • Prefer a project-local or otherwise isolated installation rather than modifying the user's global npm environment.

  • Use --ignore-scripts when compatible with the package and required functionality.

  • Apply dependency monitoring and require security review before updating the pinned version.

  • Run the CLI with a minimally privileged Notion integration and in an isolated environment where practical.

T09 · Insecure Skill Coding Practices

Note
Location
SKILL.md:18
Finding

Notion API Token Stored Without Explicit Restrictive Permissions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:18-19 and duplicated in README.md:22-23
Vulnerability Type: Insecure plaintext credential storage
Risk Level: Low

Vulnerable Code

SKILL.md:18-19:

bash
mkdir -p ~/.config/notion
echo "ntn_your_key_here" > ~/.config/notion/api_key

The token is subsequently loaded into an environment variable in SKILL.md:27:

bash
export NOTION_TOKEN=$(cat ~/.config/notion/api_key)

Equivalent credential-storage instructions appear in README.md:22-23.

Technical Analysis

The setup instructions store a long-lived Notion integration token in a plaintext file but do not explicitly restrict the permissions of either the configuration directory or the credential file. Effective permissions depend on the user's existing umask and filesystem configuration.

Under permissive defaults, another local account or process may be able to read the token. Exporting the token into the environment also makes it available to child processes and may expose it through process inspection or diagnostic collection under some operating-system and runtime configurations.

Although plaintext storage is sometimes necessary for command-line tools, credentials should be protected with least-privilege filesystem permissions or stored through an operating-system credential manager.

Attack Path

  1. A user follows the documented setup instructions.
  2. The API token is written to ~/.config/notion/api_key using permissions derived from the current umask.
  3. The resulting directory or file is readable by an unintended local principal or compromised process.
  4. The attacker reads the token from the file or captures it from the environment of a process using the CLI.
  5. The attacker authenticates to the Notion API with the stolen token.
  6. The attacker accesses or modifies resources available to the corresponding Notion integration.

Impact Assessment

A di ...[truncated 674 chars]

Remediation
View remediation

Remediation Suggestions

  • Create the configuration directory with owner-only permissions:

    bash
    install -d -m 700 "$HOME/.config/notion"

  • Write the token without exposing it in command history and enforce mode 600:

    bash
    umask 077
printf '%s' "$NOTION_TOKEN_INPUT" > "$HOME/.config/notion/api_key"
chmod 600 "$HOME/.config/notion/api_key"

  • Prefer an operating-system credential store or dedicated secrets manager rather than a plaintext file.

  • Avoid placing the literal token directly in interactive shell commands, shell history, documentation, logs, or process arguments.

  • Restrict the Notion integration to only the capabilities and resources required for the intended tasks.

  • Rotate the token immediately if unauthorized access is suspected.

  • Document a token revocation and rotation procedure.

  • Consider loading the credential only for the lifetime of the required command rather than exporting it broadly to an entire shell session.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (13)

Session Persistence

Medium
Category
Rogue Agent
Confidence
89% confidence
Finding

The README recommends persisting the Notion API token in a plaintext file under ~/.config/notion/api_key. Storing long-lived credentials unencrypted on disk increases the risk of token theft by other local users, malware, backups, shell-history mistakes, or accidental inclusion in support bundles and dotfile sync workflows.

Content

Scanner excerpt · README.md (reported line 22)May include surrounding context.

Ou configurez le fichier :

bash
mkdir -p ~/.config/notion
echo "ntn_your_key_here" > ~/.config/notion/api_key

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The README documents create and update operations against a user's Notion workspace without an explicit warning that these actions modify live data. In an agent skill context, this increases the chance of unintended writes because users or downstream agents may treat the examples as routine read operations rather than state-changing actions.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
86% confidence
Finding

The documentation directs users to persist the API key in a predictable local file under ~/.config/notion and then export it for use, but it does not mention filesystem permissions, secret storage practices, or exposure risks. In shared systems or agent-driven environments, persistent local secrets can be read by other processes, accidentally synced, or disclosed through weak local hygiene.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

md
## Setup

- Install notion-cli: `npm install -g @iansinnott/notion-cli`
- Create an integration at https://notion.so/my-integrations
- Copy the API key (starts with *ntn_* or *secret_*)
- Store it:
  - `mkdir -p ~/.config/notion`

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill instructs users to copy, store, and export a Notion API token without clearly identifying it as a sensitive secret that grants access to workspace data. In a tool/agent environment, omission of credential-handling warnings can lead to token leakage through shell history, logs, screenshots, or insecure filesystem permissions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The documentation includes create and update operations that modify live Notion pages and databases, but it does not clearly warn users that these commands write to remote data rather than only reading it. In an agent-skill context, this increases the chance of unintended destructive or unauthorized changes if a user or downstream agent runs examples assuming they are safe to inspect.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 55)May include surrounding context.

  • Create page in a database:

    bash
    curl -X POST https://api.notion.com/v1/pages \
  -H "Authorization: Bearer $NOTION_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Notion-Version: 2025-09-03" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 64)May include surrounding context.

  • Create page in a database:

    bash
    curl -X POST https://api.notion.com/v1/pages \
  -H "Authorization: Bearer $NOTION_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Notion-Version: 2025-09-03" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

  • Create page in a database:

    bash
    curl -X POST https://api.notion.com/v1/pages \
  -H "Authorization: Bearer $NOTION_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Notion-Version: 2025-09-03" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.

  • Create page in a database:

    bash
    curl -X POST https://api.notion.com/v1/pages \
  -H "Authorization: Bearer $NOTION_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Notion-Version: 2025-09-03" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 159)May include surrounding context.

  • Create page in a database:

    bash
    curl -X POST https://api.notion.com/v1/pages \
  -H "Authorization: Bearer $NOTION_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Notion-Version: 2025-09-03" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

  • Create page in a database:

    bash
    curl -X POST https://api.notion.com/v1/pages \
  -H "Authorization: Bearer $NOTION_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Notion-Version: 2025-09-03" \

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

Tout le contenu utilisateur du skill est rédigé en français, sans mention d’un choix de langue, d’une option multilingue, ni d’une justification régionale. Cela peut contrevenir à une politique organisationnelle exigeant de ne pas forcer une langue ou une locale sans opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The sample payloads use French text such as "Nouvelle idée", "Nouveau titre", and "Description mise à jour" in otherwise English documentation. This imposes a specific language in example outputs without user opt-in or justification that the skill is intended for a French-language context.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.