Is notion safe?
https://clawhub.ai/skill/notion
This is a legitimate Notion API integration skill that provides standard REST API documentation for creating, reading, updating, and deleting Notion pages and databases. The skill contains no prompt injection, no hidden instructions, no malicious code, and no data exfiltration attempts. The primary concerns are the plaintext API key storage pattern and the inherent risk of an agent making authenticated API calls to an external service. Clone-time monitoring detected no suspicious behavior.
Category Scores
Findings (5)
MEDIUM Plaintext API key storage and shell exposure -15 ▶
The skill instructs users to store their Notion API key in a plaintext file at ~/.config/notion/api_key and then read it via $(cat ~/.config/notion/api_key) in curl commands. This means the key appears in shell command arguments (visible in ps output and shell history) and is stored without filesystem encryption or access controls. While this is a common pattern in API documentation, it creates a credential that any process on the system can read.
LOW API key sent to external endpoint -13 ▶
The skill instructs sending the API key to api.notion.com endpoints. While this is the legitimate and intended use, it means the agent will be making authenticated external API calls. The risk is low since the target is Notion's official API, but users should be aware their agent will be making authenticated requests to an external service.
LOW Broad agent capability implied without scope limitation -15 ▶
The skill provides comprehensive CRUD operations for Notion (search, create, update, delete pages and databases) without any scope limitations or guardrails. While not malicious, this gives an agent broad write access to a user's Notion workspace. A prompt injection from another source could leverage these capabilities to modify or delete Notion content.
LOW Bash code blocks as documentation templates -20 ▶
The skill contains numerous bash code blocks with curl commands. These are documentation-style examples intended to be executed by the agent. While they only target api.notion.com, the pattern of providing executable bash templates means the agent will run shell commands. The commands themselves are safe and standard API calls.
INFO Combination risk with other skills -30 ▶
If combined with a malicious skill that can read ~/.config/notion/api_key or intercept curl commands, the Notion API key could be exfiltrated. The skill itself is benign, but the credential storage pattern creates a target for other malicious skills.