Security audit

Notion API Integration

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed Notion API helper that uses local Clawic notes and the user's Notion token for expected integration work, with no evidence of hidden exfiltration or destructive automation.

Install this only if you want an agent to use your Notion integration token and keep local memory about reachable Notion schemas, IDs, mappings, runs, and selected contacts. Use least-privilege Notion capabilities, keep write_mode as confirm-writes or dry-run for migrations, and review ~/Clawic/data/notion-api-integration/ if workspace structure should not be retained locally.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Context-Inappropriate Capability

Low

Confidence: 94% confidence
Finding: The documentation instructs the agent to write artifacts to a fixed path under the user's home directory (`~/Clawic/data/notion-api-integration/...`) without confirming that file writes are expected or safe in the current environment. In an agent setting, hard-coded persistence paths can cause unintended local file creation, overwrite existing notes/artifacts, and bypass user intent even if the content written is non-executable.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The documentation instructs copying real workspace person/contact information into shared local files outside the core Notion API troubleshooting purpose. That creates unnecessary local persistence of personal data, increases exposure to other tools or users on the system, and can violate least-privilege and data-minimization expectations even if no secret is stored.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill explicitly instructs the agent to save generated content to a local filesystem path under the user's home directory without requiring explicit user consent at the point of write. In an agent setting, this can cause unauthorized persistence of potentially sensitive workspace data, create unexpected side effects, and normalize file writes that the user did not request in the current turn.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: This instruction tells the agent to create or update files in the user's home directory but provides no user-facing disclosure or consent step. In practice, that can lead to silent filesystem side effects from a documentation-following agent, which is especially risky because the path is specific and persistent, making repeated or automated modifications likely.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The file includes multiple live write examples for creating, updating, and archiving Notion pages using real API endpoints and bearer-token auth, but it does not prominently warn users that these commands mutate production workspace data. In a troubleshooting/debugging skill, users may copy-paste examples directly, increasing the chance of unintended data creation, modification, or archival in live environments.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill instructs the agent to persist discovered Notion workspace metadata — including IDs, names, purposes, and unexpected reachable items — into a local memory file without any consent, minimization, or sensitivity warning. That creates a durable inventory of potentially sensitive internal structure that can outlive the immediate task and be reused in later sessions, increasing exposure if local state is accessed by other tasks, users, or compromised tooling.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill tells the agent to write personal contact details such as name, role, preferred channel, context, and identifiers into local files without warning about privacy, retention, consent, or access controls. In a shared agent environment, that can lead to silent accumulation of personal data and broaden who or what can access it.

Ssd 3

Medium

Confidence: 92% confidence
Finding: These instructions direct a full discovery pass over all reachable databases and schemas, then require persisting their identifiers, names, and purposes for future reuse. In the context of an integration skill, this goes beyond troubleshooting a single object and effectively builds a stored map of accessible workspace resources, which could expose confidential project names, organizational structure, or targets for later misuse.

Ssd 3

Medium

Confidence: 94% confidence
Finding: The skill explicitly tells the agent to record 'anything reachable that the user did not expect' into persistent memory. That is risky because it captures potentially unauthorized or surprising access paths and preserves them for later use, turning a one-time discovery result into durable sensitive intelligence about the user's workspace.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.