ClawHub
Back to skill

Security audit

Notion

Security checks for vulnerabilities and agentic risk

Overview

This Notion skill appears legitimate, but needs review because it can modify/delete workspace content and installs an inconsistent unpinned global npm package while persisting API credentials.

Review before installing. Use a least-privilege Notion integration shared only with intended pages/databases, avoid running destructive commands unless the target is uniquely identified and confirmed, verify the npm package identity/version manually, and rotate the Notion token if it may have been exposed through command-line history, process logs, or unclear local storage.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Error
Location
install.sh:3
Finding

Conflicting and Unpinned Globally Installed npm Dependency

Content
View full analysis

Vulnerability Details

File Location: install.sh:3; related conflicting declarations in SKILL.md:9 and SKILL.md:18
Vulnerability Type: Supply-chain ambiguity and unsafe dependency resolution
Risk Level: High

Vulnerable Code

install.sh:1-4:

bash
#!/bin/bash
# Install notioncli globally
npm install -g notioncli
echo "✅ notioncli installed. Run: notion init --key \$NOTION_API_KEY"

Conflicting package declarations in SKILL.md:

yaml
install: "npm install -g @jordancoin/notioncli"
bash
npm install -g notioncli

Technical Analysis

The metadata identifies the scoped package @jordancoin/notioncli, whereas the executable installation script and Setup documentation install the distinct unscoped package notioncli. This inconsistent package identity can cause users to install a different package from the one represented by the Skill metadata.

Neither installation command pins an exact version or verifies package integrity. npm therefore resolves the current registry version at installation time. In addition, npm install can execute package lifecycle scripts. Because installation is global, such scripts run with the installing user's permissions and can place executable files in global npm paths.

The third-party CLI implementation is not included in this project, so its install-time and runtime behavior cannot be verified by this audit.

Attack Path

  1. A user runs install.sh or follows the Setup command in SKILL.md.
  2. npm resolves the mutable, unscoped notioncli package rather than the scoped package declared in metadata.
  3. A malicious, compromised, or unintended release executes npm lifecycle scripts during global installation.
  4. The installed executable gains the installing user's privileges and may modify files accessible to that user.
  5. The user subsequently invokes the CLI with a Notion API key, potentially exposing that credential and its authorized workspace data to the installed packag ...[truncated 459 chars]
Remediation
View remediation

Remediation Suggestions

  • Use one verified package identity consistently in metadata, documentation, and installation scripts.
  • Pin an exact reviewed version, for example @scope/package@1.2.1, rather than resolving the latest release.
  • Commit and verify a lockfile and package integrity metadata where the installation model permits it.
  • Prefer a project-local installation over npm install -g to reduce system-wide effects.
  • Review package provenance, ownership, signatures, published contents, and lifecycle scripts before installation.
  • Disable lifecycle scripts with --ignore-scripts when they are not required.
  • Execute the CLI with least privilege and never run the installation as root.
  • Re-audit the exact dependency source and version before presenting the Skill as trusted.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:18
Finding

Notion API Key Exposed Through Command-Line Arguments

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:18, SKILL.md:322-323, and SKILL.md:333; related instruction in install.sh:4
Vulnerability Type: Sensitive credential exposure through process arguments and undocumented persistent storage
Risk Level: Medium

Vulnerable Code

SKILL.md:17-18:

bash
npm install -g notioncli
notion init --key $NOTION_API_KEY

SKILL.md:322-323:

bash
notion workspace add work --key ntn_work_key       # Add workspace
notion workspace add personal --key ntn_personal    # Add another

SKILL.md:333:

bash
notion init --workspace work --key ntn_work_key

Related instruction in install.sh:4:

bash
echo "✅ notioncli installed. Run: notion init --key \$NOTION_API_KEY"

The documentation also states that the init command saves the API key, but does not describe storage location, file permissions, or encryption.

Technical Analysis

The documented initialization flow expands NOTION_API_KEY into the --key command-line argument. Command-line arguments can be exposed through operating-system process inspection, diagnostic tools, execution telemetry, shell tracing, command wrappers, CI logs, or audit facilities. The literal placeholder examples for workspace profiles encourage the same insecure credential-handling pattern.

Although normal shell history generally records the unexpanded variable reference when $NOTION_API_KEY is used, the expanded value can still be visible in the spawned process's argument vector and in tooling that records executed commands after expansion.

The Skill further indicates that the CLI persistently saves credentials. Because the dependency's implementation is absent, this audit cannot verify whether stored tokens receive restrictive permissions, encryption, or operating-system credential-store protection.

Attack Path

  1. The user exports a valid Notion integration token and runs notion init --key $NOTION_API_KEY.
  2. The shell expands the en ...[truncated 1017 chars]
Remediation
View remediation

Remediation Suggestions

  • Do not transmit credentials through command-line options.
  • Have the CLI read NOTION_API_KEY directly from the environment without copying it into argv, or accept the token through protected standard input with terminal echo disabled.
  • Remove --key examples from the documentation and installation output.
  • Store persistent credentials in the operating system's credential manager or secret service.
  • If file storage is unavoidable, use a user-owned file with mode 0600, an access-controlled directory, atomic creation, and no secret-bearing logs or backups.
  • Document the credential storage location, protection model, rotation process, and deletion behavior.
  • Redact secrets from debug output, telemetry, crash reports, and error messages.
  • Rotate any token that may already have been exposed and review its Notion integration access for least privilege.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill documents destructive and state-changing commands such as delete, update, move, block-delete, and schema modification without prominent warnings, confirmation guidance, or safe-usage constraints. In an agent-facing skill, this increases the chance that an LLM or user will execute irreversible or hard-to-recover changes to Notion content based on ambiguous prompts or mistaken targeting.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The manifest explicitly advertises destructive and data-modifying capabilities such as update, delete, block CRUD, database management, and page moves, but it does not warn users that the skill can alter or remove Notion data. In an AI-agent context, this increases the risk of unintended destructive actions because users may invoke the skill without understanding that write operations are supported alongside read/query features.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.