notion

• Outcome: Review
• Latest audit: Sep 15, 2026 · 9:24 PM UTC
• Version: 1.0.0

Overview

This Notion skill is a straightforward CLI/API guide with expected Notion access, but users should be careful with tokens, destructive commands, worker deployment, and the unpinned npm install.

Install only if you trust the ntn npm package and Notion account scope you will use. Prefer a least-privileged Notion integration token, avoid running npm install with admin privileges, and review commands that trash pages, patch raw API endpoints, upload files, or deploy Workers before executing them.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:14

Finding

Unpinned Global npm Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 14–20 and 32–36
Vulnerability Type: Supply-chain exposure through an unpinned npm dependency
Risk Level: Medium

Vulnerable Code

json

{
  "id": "node",
  "kind": "node",
  "package": "ntn",
  "bins": ["ntn"],
  "label": "Install official Notion CLI (npm)",
},

bash

npm install -g ntn
ntn --version
ntn login

Technical Analysis

The skill installs the ntn package globally from the npm registry without specifying an exact version or verifying its integrity. Consequently, the package contents installed during future skill setup operations are determined by whichever release the registry resolves at that time, rather than the release reviewed when this skill was audited.

Global npm installation may execute package lifecycle scripts such as preinstall, install, and postinstall. If the package, a transitive dependency, its publisher account, or the package distribution channel is compromised, malicious installation code could execute with the privileges of the user performing setup. The globally installed ntn executable is subsequently trusted for authentication and Notion API operations.

This finding does not establish that the current ntn package is malicious. It identifies the absence of version pinning and integrity controls as an exploitable supply-chain weakness.

Attack Path

1. An attacker compromises the npm publisher account, package release process, or a transitive dependency associated with ntn.
2. The attacker publishes a malicious version that is accepted by the unpinned package reference.
3. A user or automated installer processes the skill metadata or follows the documented npm install -g ntn command.
4. npm downloads the attacker-controlled release and may execute its lifecycle scripts during installation.
5. The malicious package executes with the installing user's privileges and in ...[truncated 919 chars]

Remediation

View remediation

Remediation Suggestions

• Pin ntn to a reviewed exact version in both installation metadata and documentation, for example:

  json

  "package": "ntn@<reviewed-exact-version>"
  

  bash

  npm install -g --ignore-scripts ntn@<reviewed-exact-version>
  

• Verify the selected package version, publisher, provenance, dependency tree, and published integrity digest before recommending it.

• Prefer a lockfile-backed, project-local installation over a mutable global installation where the execution environment supports it.

• Use npm provenance or equivalent signed-artifact verification when available.

• Disable lifecycle scripts with --ignore-scripts if the reviewed CLI does not require them.

• Do not run npm installation with sudo or an administrative account.

• Execute the CLI under a dedicated least-privileged account and use a narrowly scoped Notion integration token.

• Separate installation from authentication so secrets are not present while unreviewed installation code is executing.

• Establish a controlled dependency-update process in which each new pinned release is reviewed and tested before updating the skill.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

md

# Notion

Prefer official `ntn` CLI. Use curl only when `ntn` is unavailable or a raw request is clearer.

## Setup

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The markdown includes ntn pages trash <page-id> --yes, which performs a destructive action and explicitly bypasses confirmation. The surrounding documentation does not warn the user that this will move the page to trash or discuss the impact of using --yes.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 138)May include surrounding context.

Curl fallback

bash

curl -sS "https://api.notion.com/v1/users/me" \
  -H "Authorization: Bearer $NOTION_API_TOKEN" \
  -H "Notion-Version: 2026-03-11" \
  -H "Content-Type: application/json"

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 74% confidence

Finding

ntn workers deploy can push changes to Notion Workers, affecting workspace behavior or automation. The skill lists the command but does not warn that deployment changes remote state or may impact production environments.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:41