T09 · Insecure Skill Coding Practices
- Location
SKILL.md:15- Finding
Notion API Key Stored Without Restrictive File Permissions
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 15–16
Vulnerability Type: Insecure credential storage
Risk Level: MediumVulnerable Code
bash mkdir -p ~/.config/notion echo "ntn_your_key_here" > ~/.config/notion/api_keyTechnical Analysis
The setup instructions write a Notion bearer token to a plaintext file without explicitly restricting the permissions of either the configuration directory or the credential file. Their resulting permissions depend on the user's current
umask. With a commonly used022mask, the directory may be created with mode0755and the file with mode0644, potentially making the API key readable by other local users.Because the file contains a bearer token, possession of the value is sufficient to authenticate as the Notion integration. No executable scripts automatically perform this setup, but users who follow the documented commands can create the insecure condition.
Attack Path
- A user follows the setup instructions and stores a valid Notion integration token in
~/.config/notion/api_key. - The user's
umaskpermits group or world read access, resulting in an inadequately protected credential file. - Another local user or a compromised process operating under another account reads the file.
- The attacker submits the stolen token in the
Authorization: Bearerheader tohttps://api.notion.com. - The attacker reads or modifies Notion resources that were shared with the affected integration.
This path requires local filesystem access and permissive resulting file permissions.
Impact Assessment
The attacker obtains the effective privileges of the compromised Notion integration. The accessible scope is limited by the integration's configured capabilities and by the pages or databases shared with it. Depending on those permissions, compromise could permit disclosure, creation, alteration, or deletion of Notion content. This iss ...[truncated 70 chars]
- A user follows the setup instructions and stores a valid Notion integration token in
- Remediation
View remediation
Remediation Suggestions
Create the directory and credential file with explicit owner-only permissions, rather than relying on the ambient
umask:bash install -d -m 700 "$HOME/.config/notion" install -m 600 /dev/null "$HOME/.config/notion/api_key" printf '%s\n' 'ntn_your_key_here' > "$HOME/.config/notion/api_key"Alternatively, apply
umask 077before creating either object:bash umask 077 mkdir -p "$HOME/.config/notion" printf '%s\n' 'ntn_your_key_here' > "$HOME/.config/notion/api_key"The instructions should also recommend verifying permissions with
stat, rotating any token that may have been exposed, granting the integration only the minimum required Notion capabilities, and sharing only necessary pages or databases with it. Users should avoid entering real tokens directly into commands that may be retained in shell history; a non-echoing prompt or suitable operating-system secret manager is preferable.