Security audit

Notion

Security checks for vulnerabilities and agentic risk

Overview

This Notion skill appears legitimate, but needs review because it can modify/delete workspace content and installs an inconsistent unpinned global npm package while persisting API credentials.

Review before installing. Use a least-privilege Notion integration shared only with intended pages/databases, avoid running destructive commands unless the target is uniquely identified and confirmed, verify the npm package identity/version manually, and rotate the Notion token if it may have been exposed through command-line history, process logs, or unclear local storage.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

Location: install.sh:3
Finding: Conflicting and Unpinned Globally Installed npm Dependency## Vulnerability Details **File Location**: `install.sh:3`; related conflicting declarations in `SKILL.md:9` and `SKILL.md:18` **Vulnerability Type**: Supply-chain ambiguity and unsafe dependency resolution **Risk Level**: High ### Vulnerable Code `install.sh:1-4`: ```bash #!/bin/bash # Install notioncli globally npm install -g notioncli echo "✅ notioncli installed. Run: notion init --key \$NOTION_API_KEY" ``` Conflicting package declarations in `SKILL.md`: ```yaml install: "npm install -g @jordancoin/notioncli" ``` ```bash npm install -g notioncli ``` ### Technical Analysis The metadata identifies the scoped package `@jordancoin/notioncli`, whereas the executable installation script and Setup documentation install the distinct unscoped package `notioncli`. This inconsistent package identity can cause users to install a different package from the one represented by the Skill metadata. Neither installation command pins an exact version or verifies package integrity. npm therefore resolves the current registry version at installation time. In addition, `npm install` can execute package lifecycle scripts. Because installation is global, such scripts run with the installing user's permissions and can place executable files in global npm paths. The third-party CLI implementation is not included in this project, so its install-time and runtime behavior cannot be verified by this audit. ### Attack Path 1. A user runs `install.sh` or follows the Setup command in `SKILL.md`. 2. npm resolves the mutable, unscoped `notioncli` package rather than the scoped package declared in metadata. 3. A malicious, compromised, or unintended release executes npm lifecycle scripts during global installation. 4. The installed executable gains the installing user's privileges and may modify files accessible to that user. 5. The user subsequently invokes the CLI with a Notion API key, potentially exposing that credential and its authorized workspace data to the installed packag ...[truncated 459 chars]
Remediation: ## Remediation Suggestions - Use one verified package identity consistently in metadata, documentation, and installation scripts. - Pin an exact reviewed version, for example `@scope/package@1.2.1`, rather than resolving the latest release. - Commit and verify a lockfile and package integrity metadata where the installation model permits it. - Prefer a project-local installation over `npm install -g` to reduce system-wide effects. - Review package provenance, ownership, signatures, published contents, and lifecycle scripts before installation. - Disable lifecycle scripts with `--ignore-scripts` when they are not required. - Execute the CLI with least privilege and never run the installation as root. - Re-audit the exact dependency source and version before presenting the Skill as trusted.

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:18
Finding: Notion API Key Exposed Through Command-Line Arguments## Vulnerability Details **File Location**: `SKILL.md:18`, `SKILL.md:322-323`, and `SKILL.md:333`; related instruction in `install.sh:4` **Vulnerability Type**: Sensitive credential exposure through process arguments and undocumented persistent storage **Risk Level**: Medium ### Vulnerable Code `SKILL.md:17-18`: ```bash npm install -g notioncli notion init --key $NOTION_API_KEY ``` `SKILL.md:322-323`: ```bash notion workspace add work --key ntn_work_key # Add workspace notion workspace add personal --key ntn_personal # Add another ``` `SKILL.md:333`: ```bash notion init --workspace work --key ntn_work_key ``` Related instruction in `install.sh:4`: ```bash echo "✅ notioncli installed. Run: notion init --key \$NOTION_API_KEY" ``` The documentation also states that the `init` command saves the API key, but does not describe storage location, file permissions, or encryption. ### Technical Analysis The documented initialization flow expands `NOTION_API_KEY` into the `--key` command-line argument. Command-line arguments can be exposed through operating-system process inspection, diagnostic tools, execution telemetry, shell tracing, command wrappers, CI logs, or audit facilities. The literal placeholder examples for workspace profiles encourage the same insecure credential-handling pattern. Although normal shell history generally records the unexpanded variable reference when `$NOTION_API_KEY` is used, the expanded value can still be visible in the spawned process's argument vector and in tooling that records executed commands after expansion. The Skill further indicates that the CLI persistently saves credentials. Because the dependency's implementation is absent, this audit cannot verify whether stored tokens receive restrictive permissions, encryption, or operating-system credential-store protection. ### Attack Path 1. The user exports a valid Notion integration token and runs `notion init --key $NOTION_API_KEY`. 2. The shell expands the en ...[truncated 1017 chars]
Remediation: ## Remediation Suggestions - Do not transmit credentials through command-line options. - Have the CLI read `NOTION_API_KEY` directly from the environment without copying it into `argv`, or accept the token through protected standard input with terminal echo disabled. - Remove `--key` examples from the documentation and installation output. - Store persistent credentials in the operating system's credential manager or secret service. - If file storage is unavoidable, use a user-owned file with mode `0600`, an access-controlled directory, atomic creation, and no secret-bearing logs or backups. - Document the credential storage location, protection model, rotation process, and deletion behavior. - Redact secrets from debug output, telemetry, crash reports, and error messages. - Rotate any token that may already have been exposed and review its Notion integration access for least privilege.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill documents destructive and state-changing commands such as delete, update, move, block-delete, and schema modification without prominent warnings, confirmation guidance, or safe-usage constraints. In an agent-facing skill, this increases the chance that an LLM or user will execute irreversible or hard-to-recover changes to Notion content based on ambiguous prompts or mistaken targeting.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The manifest explicitly advertises destructive and data-modifying capabilities such as update, delete, block CRUD, database management, and page moves, but it does not warn users that the skill can alter or remove Notion data. In an AI-agent context, this increases the risk of unintended destructive actions because users may invoke the skill without understanding that write operations are supported alongside read/query features.

Static analysis

No suspicious patterns detected.