Security audit

Notion Brain

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Notion-saving skill, but it needs review because it can persist sensitive content to Notion and workspace memory without clear per-write user confirmation.

Install only if you want an agent to create and update Notion content on your behalf. Before use, narrow activation to explicit save requests, require confirmation showing destination and operation type, remove or govern the raw Comments API path, limit Notion permissions to intended pages/databases, and avoid saving security, finance, personal, or confidential content unless explicitly approved.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:3
Finding: Automatic External and Persistent Storage Without Explicit User Consent<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:3-10`, `SKILL.md:48-63`, and `references/mcp-commands.md:267-272` **Vulnerability Type**: Persistence beyond explicit user intent **Risk Level**: Medium ### Vulnerable Code Snippets `SKILL.md:3-10`: ```yaml description: > Route high-value content into a Notion workspace with a quality gate, destination mapping, and exact MCP write patterns. ALWAYS trigger when the user says "save this to Notion", "put this in my brain", "add this to the knowledge base", "capture this for later", "log this in Notion", or any variation of saving, storing, or routing content to Notion. Also trigger when an agent produces a research summary, decision memo, project plan, status update, article draft, security audit, financial snapshot, weekly rollup, contact note, meeting prep, or other durable content that belongs in Notion. ``` `SKILL.md:48-63`: ```markdown In scope: - research summaries - decision memos - project plans and project status - article drafts - security audit reports - financial snapshots - weekly rollups - contact notes - meeting prep - quick captures worth preserving Out of scope: - health database management - property, vehicle, or equipment management - replacing workspace memory or daily logs - auto-pushing everything by default Always write to workspace memory separately when the content also matters for agent continuity. ``` `references/mcp-commands.md:267-272`: ```markdown ## Operational advice - Search first when duplicate risk is non-trivial - Use Inbox DB for ambiguous or low-structure captures - Use parent pages for durable artifacts - Append instead of recreate when a page already exists - Write to workspace memory too when the information matters for agent continuity ``` ### Technical Analysis The skill declares that it should activate not only when a user explicitly asks to save content, but also whenever an agent produces one of several broadly defined durabl ...[truncated 2963 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Require explicit user authorization before every persistent write unless the user has previously enabled a clearly defined and revocable automation policy. 2. Do not treat the generation of an artifact as sufficient authorization to store it. Restrict automatic activation to explicit save or routing requests. 3. Remove the unconditional workspace-memory instruction. Memory writes should require an independent necessity assessment and user consent. 4. Add a sensitivity gate for security, financial, personal, credential-bearing, legal, and confidential business content. Default to not saving such material. 5. Before writing, present: - The exact destination. - Whether the operation creates, appends, or replaces content. - A concise payload preview. - Whether a second copy will be written to workspace memory. 6. Require separate confirmation before `replace_content`, because that operation can overwrite an existing persistent record. 7. Apply least-privilege Notion integration permissions, limiting the integration to only the intended pages or databases. 8. Provide a configurable retention and deletion policy for both Notion and workspace memory. 9. Record user-approved write operations in an audit log containing the destination, timestamp, operation type, and authorization source, while excluding sensitive body content where possible. 10. Change the default behavior for ambiguous cases from “save to inbox” to “ask before saving.” ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Vague Triggers

High

Confidence: 97% confidence
Finding: The skill is configured to ALWAYS trigger on a very broad set of save-related phrases and even on many generic content types produced by an agent, which increases the chance of unintended activation. In a skill that writes content to an external Notion workspace, overbroad invocation can cause accidental exfiltration of sensitive summaries, audits, financial notes, or other durable content without sufficiently explicit user intent at the moment of write.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill content emphasizes routing and writing behavior but does not prominently warn that it will send user or agent-generated content to an external Notion workspace. Without a clear disclosure at decision time, users may not realize that potentially sensitive material is leaving the current conversation context and being persisted in a third-party system.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The document says to use native Notion MCP tools only, then later demonstrates a raw HTTP API call. That inconsistency can cause agents or developers to ignore the intended trust boundary and implement direct network access, undermining the safety model implied by the skill documentation.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill provides many examples for creating and updating Notion pages, including replace operations, without clearly warning that these actions modify user workspace data. In a write-capable integration, missing disclosure and confirmation guidance increases the risk of accidental overwrites, duplicate creation, or storing sensitive content in the wrong destination.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The file explicitly positions routing around native Notion MCP tools, but this section introduces a direct REST call to Notion comments. That expands the skill's operational surface beyond the declared tool boundary, creating a path for unreviewed outbound requests and content transmission that may bypass MCP-layer controls, logging, or policy enforcement.

External Transmission

Medium

Category: Data Exfiltration
Content: ```json // Create a comment on a page POST https://api.notion.com/v1/comments { "parent": { "page_id": "PAGE_ID" }, "rich_text": [{ "text": { "content": "The agent reviewed 2026-03-22. Content is current." } }]
Confidence: 93% confidence
Finding: The documented POST to api.notion.com is an explicit external transmission path for page-linked content. In the context of an agent skill, that matters because it can send user-generated text and metadata outside the local system, and here it is introduced outside the declared MCP-only mechanism.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The webhook section proposes syncing Notion changes back into agent memory or local systems, effectively broadening data flow from one-way export to ongoing ingestion. Without privacy, retention, and consent warnings, this creates a meaningful risk of over-collection, persistence of sensitive workspace content, and unintended propagation into other systems.

Static analysis

No suspicious patterns detected.