Security audit

Notion笔记工具

Security checks across malware telemetry and agentic risk

Overview

This Notion skill is mostly purpose-aligned, but it requests broad local command execution and supports real Notion changes without clear safeguards.

Review this skill carefully before installing. Use a Notion integration token with the minimum workspace access needed, avoid broad page/database sharing, and do not allow command execution or destructive Notion changes unless your agent runtime provides separate confirmation and scoping controls.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The skill asserts that command execution is limited to a whitelist, but the file only advertises generic `exec` capability and provides no actual enforcement mechanism. This creates a misleading security boundary: an agent or user may trust that shell actions are constrained when they are not, enabling arbitrary command execution if later prompts or wrappers route input into `exec`.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The declared toolset includes generic command execution even though the stated purpose is Notion page/database management via API. That unnecessarily expands the attack surface from scoped API operations to arbitrary local code execution, which could lead to host compromise, secret theft, filesystem tampering, or pivoting to other systems if the agent is induced to run commands.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The description says to use the skill for broad data analysis, report generation, statistical insight, and visualization tasks, which exceeds a narrowly defined Notion integration role. This can cause the skill to be invoked for unrelated requests, increasing chances that its powerful tools—including `exec`—are exposed in contexts where users did not intend local execution or Notion-side modifications.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill advertises delete capability for pages without a prominent warning, confirmation requirement, or safety guard around destructive actions. In an agent setting, ambiguous user requests or prompt injection could cause unintended content deletion or irreversible workspace changes, especially because Notion operations affect real user data.

VirusTotal

45/45 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.