ClawHub
Back to skill

Security audit

Notion Manager

Security checks for vulnerabilities and agentic risk

Overview

This Notion skill is coherent, but it asks users to install an unpinned global npm package and store a Notion token in plaintext before using commands that can modify live Notion data.

Review this skill before installing. Pin and verify the npm package version if possible, consider installing it in an isolated environment instead of globally, use a minimally scoped Notion integration, share only the specific pages or databases needed, and store NOTION_TOKEN in a secure credential store or at least a chmod 600 file rather than a broadly readable plaintext file.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:14
Finding
Unpinned Global Installation of a Third-Party npm Package## Vulnerability Details **File Location**: `SKILL.md:14` and duplicated in `README.md:9` **Vulnerability Type**: Unpinned third-party dependency and unclear package provenance **Risk Level**: Medium ### Vulnerable Code `SKILL.md:14`: ```bash npm install -g @iansinnott/notion-cli ``` The same installation instruction appears in `README.md:9`. ### Technical Analysis The project instructs users to install the latest available version of `@iansinnott/notion-cli` globally. It does not pin an exact reviewed version, verify a package integrity hash, provide a lockfile, or recommend disabling npm lifecycle scripts. A global npm installation can execute package lifecycle scripts with the privileges of the user running npm. Because no version is pinned, the effective code installed can change after this Skill has been reviewed. A compromised maintainer account, malicious newly published release, or package registry compromise could therefore introduce arbitrary executable behavior. Package provenance is also unclear in the audited documentation. The installed npm package is scoped as `@iansinnott/notion-cli`, while the declared homepage and reference repository are `https://github.com/litencatt/notion-cli`. The documentation does not establish or verify that the npm scope and referenced repository are controlled by the same trusted publisher. ### Attack Path 1. An attacker compromises the npm publisher account, package release process, or another relevant supply-chain component. 2. The attacker publishes a malicious version of `@iansinnott/notion-cli`. 3. A user follows the Skill instructions and runs the unpinned global installation command. 4. npm downloads the current malicious release and may execute its lifecycle scripts during installation. 5. The malicious package executes with the user's privileges. 6. It can access local files and environment variables available to the process, potentially including `NOTION_TOKEN ...[truncated 815 chars]
Remediation
## Remediation Suggestions - Pin the dependency to an exact reviewed version instead of installing the latest release: ```bash npm install -g @iansinnott/notion-cli@<reviewed-exact-version> ``` - Verify and document the relationship between the npm publisher, package scope, and referenced GitHub repository. - Publish expected package integrity information and verify the downloaded artifact before installation. - Review the selected package version, including its dependencies and npm lifecycle scripts. - Prefer a project-local or otherwise isolated installation rather than modifying the user's global npm environment. - Use `--ignore-scripts` when compatible with the package and required functionality. - Apply dependency monitoring and require security review before updating the pinned version. - Run the CLI with a minimally privileged Notion integration and in an isolated environment where practical.

T09 · Insecure Skill Coding Practices

Note
Location
SKILL.md:18
Finding
Notion API Token Stored Without Explicit Restrictive Permissions## Vulnerability Details **File Location**: `SKILL.md:18-19` and duplicated in `README.md:22-23` **Vulnerability Type**: Insecure plaintext credential storage **Risk Level**: Low ### Vulnerable Code `SKILL.md:18-19`: ```bash mkdir -p ~/.config/notion echo "ntn_your_key_here" > ~/.config/notion/api_key ``` The token is subsequently loaded into an environment variable in `SKILL.md:27`: ```bash export NOTION_TOKEN=$(cat ~/.config/notion/api_key) ``` Equivalent credential-storage instructions appear in `README.md:22-23`. ### Technical Analysis The setup instructions store a long-lived Notion integration token in a plaintext file but do not explicitly restrict the permissions of either the configuration directory or the credential file. Effective permissions depend on the user's existing umask and filesystem configuration. Under permissive defaults, another local account or process may be able to read the token. Exporting the token into the environment also makes it available to child processes and may expose it through process inspection or diagnostic collection under some operating-system and runtime configurations. Although plaintext storage is sometimes necessary for command-line tools, credentials should be protected with least-privilege filesystem permissions or stored through an operating-system credential manager. ### Attack Path 1. A user follows the documented setup instructions. 2. The API token is written to `~/.config/notion/api_key` using permissions derived from the current umask. 3. The resulting directory or file is readable by an unintended local principal or compromised process. 4. The attacker reads the token from the file or captures it from the environment of a process using the CLI. 5. The attacker authenticates to the Notion API with the stolen token. 6. The attacker accesses or modifies resources available to the corresponding Notion integration. ### Impact Assessment A di ...[truncated 674 chars]
Remediation
## Remediation Suggestions - Create the configuration directory with owner-only permissions: ```bash install -d -m 700 "$HOME/.config/notion" ``` - Write the token without exposing it in command history and enforce mode `600`: ```bash umask 077 printf '%s' "$NOTION_TOKEN_INPUT" > "$HOME/.config/notion/api_key" chmod 600 "$HOME/.config/notion/api_key" ``` - Prefer an operating-system credential store or dedicated secrets manager rather than a plaintext file. - Avoid placing the literal token directly in interactive shell commands, shell history, documentation, logs, or process arguments. - Restrict the Notion integration to only the capabilities and resources required for the intended tasks. - Rotate the token immediately if unauthorized access is suspected. - Document a token revocation and rotation procedure. - Consider loading the credential only for the lifetime of the required command rather than exporting it broadly to an entire shell session.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (13)

Session Persistence

Medium
Category
Rogue Agent
Content
Ou configurez le fichier :

```bash
mkdir -p ~/.config/notion
echo "ntn_your_key_here" > ~/.config/notion/api_key
```
Confidence
89% confidence
Finding
The README recommends persisting the Notion API token in a plaintext file under ~/.config/notion/api_key. Storing long-lived credentials unencrypted on disk increases the risk of token theft by other local users, malware, backups, shell-history mistakes, or accidental inclusion in support bundles and dotfile sync workflows.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The README documents create and update operations against a user's Notion workspace without an explicit warning that these actions modify live data. In an agent skill context, this increases the chance of unintended writes because users or downstream agents may treat the examples as routine read operations rather than state-changing actions.

Session Persistence

Medium
Category
Rogue Agent
Content
## Setup

- Install notion-cli: `npm install -g @iansinnott/notion-cli`
- Create an integration at https://notion.so/my-integrations
- Copy the API key (starts with *ntn_* or *secret_*)
- Store it:
  - `mkdir -p ~/.config/notion`
Confidence
86% confidence
Finding
The documentation directs users to persist the API key in a predictable local file under ~/.config/notion and then export it for use, but it does not mention filesystem permissions, secret storage practices, or exposure risks. In shared systems or agent-driven environments, persistent local secrets can be read by other processes, accidentally synced, or disclosed through weak local hygiene.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill instructs users to copy, store, and export a Notion API token without clearly identifying it as a sensitive secret that grants access to workspace data. In a tool/agent environment, omission of credential-handling warnings can lead to token leakage through shell history, logs, screenshots, or insecure filesystem permissions.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The documentation includes create and update operations that modify live Notion pages and databases, but it does not clearly warn users that these commands write to remote data rather than only reading it. In an agent-skill context, this increases the chance of unintended destructive or unauthorized changes if a user or downstream agent runs examples assuming they are safe to inspect.

External Transmission

Medium
Category
Data Exfiltration
Content
- **Create page in a database:**

  ```bash
  curl -X POST https://api.notion.com/v1/pages \
    -H "Authorization: Bearer $NOTION_TOKEN" \
    -H "Content-Type: application/json" \
    -H "Notion-Version: 2025-09-03" \
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
- **Create page in a database:**

  ```bash
  curl -X POST https://api.notion.com/v1/pages \
    -H "Authorization: Bearer $NOTION_TOKEN" \
    -H "Content-Type: application/json" \
    -H "Notion-Version: 2025-09-03" \
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
- **Create page in a database:**

  ```bash
  curl -X POST https://api.notion.com/v1/pages \
    -H "Authorization: Bearer $NOTION_TOKEN" \
    -H "Content-Type: application/json" \
    -H "Notion-Version: 2025-09-03" \
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
- **Create page in a database:**

  ```bash
  curl -X POST https://api.notion.com/v1/pages \
    -H "Authorization: Bearer $NOTION_TOKEN" \
    -H "Content-Type: application/json" \
    -H "Notion-Version: 2025-09-03" \
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
- **Create page in a database:**

  ```bash
  curl -X POST https://api.notion.com/v1/pages \
    -H "Authorization: Bearer $NOTION_TOKEN" \
    -H "Content-Type: application/json" \
    -H "Notion-Version: 2025-09-03" \
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
- **Create page in a database:**

  ```bash
  curl -X POST https://api.notion.com/v1/pages \
    -H "Authorization: Bearer $NOTION_TOKEN" \
    -H "Content-Type: application/json" \
    -H "Notion-Version: 2025-09-03" \
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Natural-Language Policy Violations

Low
Confidence
89% confidence
Finding
Tout le contenu utilisateur du skill est rédigé en français, sans mention d’un choix de langue, d’une option multilingue, ni d’une justification régionale. Cela peut contrevenir à une politique organisationnelle exigeant de ne pas forcer une langue ou une locale sans opt-in.

Natural-Language Policy Violations

Low
Confidence
83% confidence
Finding
The sample payloads use French text such as "Nouvelle idée", "Nouveau titre", and "Description mise à jour" in otherwise English documentation. This imposes a specific language in example outputs without user opt-in or justification that the skill is intended for a French-language context.

Static analysis

No suspicious patterns detected.