ClawHub
Back to skill

Security audit

Notion

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Notion integration skill, but users should be careful because it can change shared Notion content through an external plugin and API key.

Install this only if you trust the MorphixAI/OpenClaw plugin source, use a revocable MORPHIXAI_API_KEY, and share only the Notion pages or databases the agent truly needs. Treat create, update, append, and archive actions as real changes to your Notion workspace and approve them deliberately.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:14
Finding
Unpinned Third-Party Plugin Installation## Vulnerability Details **File Location**: `SKILL.md:14` **Vulnerability Type**: Unpinned external dependency **Risk Level**: Medium ### Vulnerable Code ```text 1. **安装插件**: `openclaw plugins install openclaw-morphixai` ``` ### Technical Analysis The skill instructs users to install the external `openclaw-morphixai` plugin without specifying an immutable version, integrity checksum, cryptographic signature, or trusted registry. Because the plugin implementation is not included in this project, its behavior could not be reviewed as part of the audit. The mutable package reference may resolve to a different artifact in the future. If the package publisher, distribution account, or registry is compromised, users following this instruction could install attacker-controlled code. The installed plugin may operate with the agent's privileges and may have access to the `MORPHIXAI_API_KEY` environment variable and data available through the linked Notion integration. ### Attack Path 1. An attacker compromises the plugin publisher, distribution account, or package source. 2. The attacker publishes a malicious release under the expected `openclaw-morphixai` package name. 3. A user follows the documented installation command, which does not constrain the resolved version or verify its integrity. 4. OpenClaw retrieves and installs the malicious release. 5. When loaded or invoked, the plugin executes attacker-controlled behavior within the plugin's effective privilege boundary. 6. Depending on the runtime's isolation and granted integration permissions, the plugin could access the MorphixAI credential, read accessible Notion data, or modify Notion content. ### Impact Assessment A successful supply-chain compromise could expose `MORPHIXAI_API_KEY`, disclose information from Notion pages and databases shared with the integration, or modify, create, append to, and archive accessible Notion content. Arbitrary local effects are also possible if OpenClaw plugins execute ...[truncated 306 chars]
Remediation
## Remediation Suggestions 1. Pin the plugin to a specific, reviewed version rather than installing a mutable latest release. 2. Obtain the plugin only from a documented and trusted registry or publisher. 3. Verify a publisher signature, provenance attestation, or cryptographic checksum before installation. 4. Lock the reviewed dependency version and require an explicit security review before upgrades. 5. Review the plugin source code and requested permissions before deployment. 6. Run the plugin with least privilege and isolate it from unrelated environment variables and filesystem resources. 7. Grant the linked Notion integration access only to the pages and databases required for the intended workflow. 8. Use a scoped, revocable API key and rotate it immediately if plugin or publisher compromise is suspected.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill prominently documents write-capable and destructive actions such as create_page, update_page, append_blocks, and archive_page, but it does not provide an explicit warning that these operations modify or remove user content. In an agent setting, this increases the chance of accidental data loss or unauthorized changes if the model invokes these actions without clear user confirmation, even though access is limited to resources shared with the integration.

Natural-Language Policy Violations

Low
Confidence
84% confidence
Finding
The natural-language instructions and descriptions are entirely in Chinese, which effectively forces a specific language for users without opt-in or explanation. Under the language/locale policy, this should be either optional for the user or explicitly justified as region-specific.

Static analysis

No suspicious patterns detected.