Skip to content
skillsafebeta
← Report library
Purpose / Other

Notion API Skill Security Audit

What the author says it does (original text)

>

Independent security check

Security risks found

Files checked
5
Risks found
1
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Medium risk

The token may be exposed through chat context or local process arguments

Source references: 3
What we found

When the environment variable is absent, the Skill tells the agent to request the API key from the user; an ordinary conversation is not a dedicated secret-entry channel. Its examples also cause the shell to expand the token into a curl command-line argument, which other local processes or users may briefly see on some shared systems. The instruction not to echo the token does not remove either exposure path.

Why this matters

Anyone obtaining the token could read content within the Notion integration’s scope and may be able to create, modify, archive, or delete content.

When no environment token exists, the Skill explicitly asks the user to provide the API key in the conversation, placing the credential in conversational context. Its curl example also expands the environment variable into an Authorization argument; on systems where process arguments are visible to other users or processes, the token may be briefly exposed. The no-display/no-log warning helps but does not remove either path. Users can ask for a dedicated secret-input/storage mechanism and restrict process visibility and the token's Notion permissions.

SKILL.md:18In the instructionsOpen original file
1. **Environment Variable**: Check if `NOTION_API_TOKEN` is available in the environment2. **User-Provided Key**: If the user provides an API key in context, use that instead3. **No Key Available**: If neither is available, use AskUserQuestion (or equivalent) to request the API key from the user**IMPORTANT**: Never display, log, or send `NOTION_API_TOKEN` anywhere except in the `Authorization` header. Confirm its existence, ask if missing, use it in requests—but never echo or expose it.
Show 2 other places
SKILL.md:28In the instructionsOpen original file
```bash-H "Authorization: Bearer $NOTION_API_TOKEN" \-H "Notion-Version: 2025-09-03" \-H "Content-Type: application/json"```
SKILL.md:38In the instructionsOpen original file
```bashcurl -s "https://api.notion.com/v1/users/me" \  -H "Authorization: Bearer $NOTION_API_TOKEN" \  -H "Notion-Version: 2025-09-03" | jq```
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

8 instruction sections

This Skill is an instruction set for calling the Notion REST API directly. It uses an integration token to read or change workspace content accessible to that token; no executable scripts are included.

View source
SKILL.md:12In the instructionsOpen original file
This skill enables interaction with Notion workspaces through the Notion REST API. Use `curl` and `jq` for direct REST calls, or write ad-hoc scripts as appropriate for the task.
SKILL.md:46In the instructionsOpen original file
- **Base URL**: `https://api.notion.com`- **API Version**: `2025-09-03` (required header)- **Data Format**: JSON for all request/response bodies- **IDs**: UUIDv4 format (dashes optional in requests)

It covers search, pages, blocks, databases, users, and comments, so effective access depends on which resources the user has shared with the Notion integration. Its search guidance can examine all pages and databases accessible to the token.

View source
SKILL.md:90In the instructionsOpen original file
### SearchSearch across all accessible pages and databases:```bashcurl -s -X POST "https://api.notion.com/v1/search" \  -H "Authorization: Bearer $NOTION_API_TOKEN" \
SKILL.md:366In the instructionsOpen original file
### Users#### List All Users```bashcurl -s "https://api.notion.com/v1/users?page_size=100" \  -H "Authorization: Bearer $NOTION_API_TOKEN" \  -H "Notion-Version: 2025-09-03" | jq```

The Skill explicitly requires confirmation before modifications, deletion, schema changes, and bulk operations, and recommends retrieving current state before updates. Block deletion moves content to trash and is described as recoverable.

View source
SKILL.md:77In the instructionsOpen original file
## Confirmation for Destructive Operations**IMPORTANT**: Before executing any operation that modifies or deletes data, ask the user for confirmation. This includes:- Updating pages or blocks- Deleting/archiving pages or blocks- Modifying database schemas- Creating pages (if multiple or in batch)- Any bulk operationsFor a logical group of related operations, a single confirmation is sufficient.
SKILL.md:260In the instructionsOpen original file
#### Delete a Block```bashcurl -s -X DELETE "https://api.notion.com/v1/blocks/{block_id}" \  -H "Authorization: Bearer $NOTION_API_TOKEN" \  -H "Notion-Version: 2025-09-03" | jq```Moves block to trash (can be restored).
SKILL.md:483In the instructionsOpen original file
5. **Check `has_more`**: Always handle pagination for list endpoints6. **Validate Before Updates**: Retrieve current state before making updates7. **Use Environment Variables**: Never hardcode API keys8. **Handle Errors Gracefully**: Check response status codes and error messages

The main document uses `NOTION_API_TOKEN`, but two reference examples use `NOTION_API_KEY`. If only the former is set, those reference commands may send an empty Authorization value and fail.

View source
SKILL.md:18In the instructionsOpen original file
1. **Environment Variable**: Check if `NOTION_API_TOKEN` is available in the environment2. **User-Provided Key**: If the user provides an API key in context, use that instead3. **No Key Available**: If neither is available, use AskUserQuestion (or equivalent) to request the API key from the user
references/filters-and-sorts.md:9In the instructionsOpen original file
```bashcurl -s -X POST "https://api.notion.com/v1/databases/{database_id}/query" \  -H "Authorization: Bearer $NOTION_API_KEY" \  -H "Notion-Version: 2025-09-03" \  -H "Content-Type: application/json" \
references/property-types.md:658In the instructionsOpen original file
```bashcurl -s "https://api.notion.com/v1/pages/{page_id}/properties/{property_id}" \  -H "Authorization: Bearer $NOTION_API_KEY" \  -H "Notion-Version: 2025-09-03"```
Start here · InstructionsSKILL.md
notion-api
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source. 2 more sections are available in the original file.

File reference map

References: 4
Files making referencesReferenced content
Lines show actual file references, not execution order. Select a node to highlight its connections and inspect the files and source locations. Dashed lines include files that still need locating.
Files and check records5 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • references/block-types.mdFull text included
  • references/filters-and-sorts.mdFull text included
  • references/property-types.mdFull text included
  • references/rich-text.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
  • references/block-types.mdSupporting file
  • references/filters-and-sorts.mdSupporting file
  • references/property-types.mdSupporting file
  • references/rich-text.mdSupporting file

Operations mentioned in code and instructions

Connect to websites
SKILL.md:12In the instructionsOpen original file
This skill enables interaction with Notion workspaces through the Notion REST API. Use `curl` and `jq` for direct REST calls, or write ad-hoc scripts as appropriate for the task.
SKILL.md:39In the instructionsOpen original file
```bashcurl -s "https://api.notion.com/v1/users/me" \  -H "Authorization: Bearer $NOTION_API_TOKEN" \
SKILL.md:46In the instructionsOpen original file
- **Base URL**: `https://api.notion.com`- **API Version**: `2025-09-03` (required header)
Run commands
SKILL.md:28In the instructionsOpen original file
```bash-H "Authorization: Bearer $NOTION_API_TOKEN" \
SKILL.md:38In the instructionsOpen original file
```bashcurl -s "https://api.notion.com/v1/users/me" \
SKILL.md:94In the instructionsOpen original file
```bashcurl -s -X POST "https://api.notion.com/v1/search" \
Read keys or account settings
references/filters-and-sorts.md:11In the instructionsOpen original file
curl -s -X POST "https://api.notion.com/v1/databases/{database_id}/query" \  -H "Authorization: Bearer $NOTION_API_KEY" \  -H "Notion-Version: 2025-09-03" \
references/filters-and-sorts.md:495In the instructionsOpen original file
curl -s -X POST "https://api.notion.com/v1/databases/{database_id}/query" \  -H "Authorization: Bearer $NOTION_API_KEY" \  -H "Notion-Version: 2025-09-03" \
references/property-types.md:660In the instructionsOpen original file
curl -s "https://api.notion.com/v1/pages/{page_id}/properties/{property_id}" \  -H "Authorization: Bearer $NOTION_API_KEY" \  -H "Notion-Version: 2025-09-03"
Lines read
2,697
File checksum (to compare versions)
befd9e5a9af5706d738553abf0e4873b288e615e207624deacf45c805b880047