ClawHub
Back to skill

Security audit

Notion 1.0.0

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward Notion API reference skill with disclosed read and write examples, but users should protect the local Notion token carefully.

Before installing, use a least-privilege Notion integration, share only the pages or databases needed, store the token with owner-only permissions or a secret manager, and review any create, update, or append command before running it because those commands modify Notion content.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:15
Finding

Notion API Key Stored in a Plaintext File Without Enforced Access Restrictions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 15-17
Vulnerability Type: Plaintext credential storage with permissions determined by the user's environment
Risk Level: Medium

Vulnerable Code

bash
mkdir -p ~/.config/notion
echo "ntn_your_key_here" > ~/.config/notion/api_key

The credential is subsequently loaded at line 23:

bash
NOTION_KEY=$(cat ~/.config/notion/api_key)

Technical Analysis

The setup instructions store a long-lived Notion bearer token in a plaintext file but do not explicitly restrict permissions on either ~/.config/notion or ~/.config/notion/api_key. The resulting access permissions depend on the user's current umask and any preexisting directory permissions.

In an environment with permissive defaults, another local user or compromised process operating under a different account may be able to read the token. Because the token is used directly as a bearer credential, possession of it is sufficient to authenticate to the Notion API; no additional proof of identity is required.

Attack Path

  1. A user follows the documented setup and writes a valid Notion integration token to ~/.config/notion/api_key.
  2. The file or its parent directory receives permissions derived from a permissive umask or retains insecure preexisting permissions.
  3. Another local principal, or a compromised process with filesystem access, reads the plaintext credential.
  4. The attacker submits requests to https://api.notion.com with the stolen token in the Authorization: Bearer header.
  5. The attacker reads or modifies Notion resources available to that integration until the credential is revoked or rotated.

Impact Assessment

Successful exploitation exposes the privileges assigned to the Notion integration. Depending on which pages and databases have been shared with it, an attacker may be able to search, read, create, or modify pages, blocks, and data-source ...[truncated 224 chars]

Remediation
View remediation

Remediation Suggestions

Enforce owner-only permissions when creating both the configuration directory and credential file:

bash
install -d -m 700 ~/.config/notion
umask 077
printf '%s\n' "ntn_your_key_here" > ~/.config/notion/api_key
chmod 600 ~/.config/notion/api_key

Additionally:

  • Prefer an operating-system credential manager or dedicated secret store instead of a plaintext file.
  • Verify that an existing ~/.config/notion directory is owned by the expected user and is not writable by other principals.
  • Grant the Notion integration only the API capabilities and workspace resources required for its intended tasks.
  • Document procedures for revoking and rotating the token if local credential exposure is suspected.
  • Avoid printing the token in terminal output, logs, shell tracing, or command history.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (13)

Session Persistence

Medium
Category
Rogue Agent
Confidence
88% confidence
Finding

The skill recommends persisting a reusable Notion API key under ~/.config/notion/api_key, creating a durable credential artifact on disk without discussing permissions, rotation, or secure storage alternatives. Persistent tokens are valuable targets; if the host, backups, or local files are exposed, an attacker can reuse the token to access and modify Notion data until it is revoked.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

Setup

  1. Create an integration at https://notion.so/my-integrations
  2. Copy the API key (starts with ntn_ or secret_)
  3. Store it:
bash

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The setup instructs users to store a long-lived API key in a local file and immediately reuse it in shell commands, but it provides no warning about credential sensitivity, file permissions, shell history exposure, or avoiding accidental disclosure. In practice, this increases the chance that a powerful Notion integration token is mishandled and then used to access or modify workspace data.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

All requests need:

bash
NOTION_KEY=$(cat ~/.config/notion/api_key)
curl -X GET "https://api.notion.com/v1/..." \
  -H "Authorization: Bearer $NOTION_KEY" \
  -H "Notion-Version: 2025-09-03" \
  -H "Content-Type: application/json"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

All requests need:

bash
NOTION_KEY=$(cat ~/.config/notion/api_key)
curl -X GET "https://api.notion.com/v1/..." \
  -H "Authorization: Bearer $NOTION_KEY" \
  -H "Notion-Version: 2025-09-03" \
  -H "Content-Type: application/json"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

All requests need:

bash
NOTION_KEY=$(cat ~/.config/notion/api_key)
curl -X GET "https://api.notion.com/v1/..." \
  -H "Authorization: Bearer $NOTION_KEY" \
  -H "Notion-Version: 2025-09-03" \
  -H "Content-Type: application/json"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

All requests need:

bash
NOTION_KEY=$(cat ~/.config/notion/api_key)
curl -X GET "https://api.notion.com/v1/..." \
  -H "Authorization: Bearer $NOTION_KEY" \
  -H "Notion-Version: 2025-09-03" \
  -H "Content-Type: application/json"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

All requests need:

bash
NOTION_KEY=$(cat ~/.config/notion/api_key)
curl -X GET "https://api.notion.com/v1/..." \
  -H "Authorization: Bearer $NOTION_KEY" \
  -H "Notion-Version: 2025-09-03" \
  -H "Content-Type: application/json"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

All requests need:

bash
NOTION_KEY=$(cat ~/.config/notion/api_key)
curl -X GET "https://api.notion.com/v1/..." \
  -H "Authorization: Bearer $NOTION_KEY" \
  -H "Notion-Version: 2025-09-03" \
  -H "Content-Type: application/json"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.

All requests need:

bash
NOTION_KEY=$(cat ~/.config/notion/api_key)
curl -X GET "https://api.notion.com/v1/..." \
  -H "Authorization: Bearer $NOTION_KEY" \
  -H "Notion-Version: 2025-09-03" \
  -H "Content-Type: application/json"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.

All requests need:

bash
NOTION_KEY=$(cat ~/.config/notion/api_key)
curl -X GET "https://api.notion.com/v1/..." \
  -H "Authorization: Bearer $NOTION_KEY" \
  -H "Notion-Version: 2025-09-03" \
  -H "Content-Type: application/json"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.

All requests need:

bash
NOTION_KEY=$(cat ~/.config/notion/api_key)
curl -X GET "https://api.notion.com/v1/..." \
  -H "Authorization: Bearer $NOTION_KEY" \
  -H "Notion-Version: 2025-09-03" \
  -H "Content-Type: application/json"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 116)May include surrounding context.

All requests need:

bash
NOTION_KEY=$(cat ~/.config/notion/api_key)
curl -X GET "https://api.notion.com/v1/..." \
  -H "Authorization: Bearer $NOTION_KEY" \
  -H "Notion-Version: 2025-09-03" \
  -H "Content-Type: application/json"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill documents multiple state-changing Notion operations such as creating pages, creating data sources, updating properties, and appending blocks, but it does not warn that these commands will modify remote user content. In an agent setting, omission of explicit modification warnings can lead to unintended writes or destructive changes if commands are used without clear user confirmation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.