heating the forge...

@forgecat/openai_skills_notion-knowledge-capture — Security Risk Report | ForgeCat

openai_skills_notion-knowledge-capture

Security risk report for @forgecat/openai_skills_notion-knowledge-capture v0.0.10

SRC-010High

Profile claims authorship by 'OpenAI' with reference to 'https://github.com/openai/skills' repository, but no verification of actual source or commit hash provided.
Notion MCP server URL (`https://mcp.notion.com/mcp`) is external and unverified; no checksum or signature validation mechanism present.
Profile version (0.0.10) and commit hash (0e7823cca07bc2cbf34718a383f9ae92525be6a5) are declared but cannot be independently verified without access to the claimed upstream repository.

Details

Findings

System modification
skills/notion-knowledge-capture/examples/conversation-to-faq.md · SKILL-009
System modification
skills/notion-knowledge-capture/examples/conversation-to-faq.md · SKILL-009

Low

Content describes legitimate knowledge-capture workflows (converting conversations to Notion pages, FAQs, decision records) without injecting malicious instructions.
Examples and reference materials document standard Notion API usage patterns (notion-search, notion-fetch, notion-create-pages, notion-update-page) for documented purposes.
No instructions to read sensitive files (~/.ssh, ~/.aws, .env), exfiltrate data, hide instructions, install remote payloads, or leak system prompts.

Details

Evidence

Skill description: 'Capture conversations and decisions into structured Notion pages; use when turning chats/notes into wiki entries, how-tos, decisions, or FAQs with proper linking.'
Workflow step 4: 'Use `Notion:notion-create-pages` with the correct `data_source_id`; set properties (title, tags, owner, status, dates, relations).'
Examples show realistic use cases (FAQ capture, decision documentation, how-to guides) with no hidden manipulation or guidance poisoning.

PRM-000Medium

The skill uses the Notion MCP which provides read and write access to the user's entire connected Notion workspace, which is broader than strictly necessary for a 'capture' use case.
The workflow instructs the agent to search, fetch, create, and update Notion pages and databases, representing meaningful write authority over the user's knowledge base.
No shell, file_write, or file_delete tools are declared, keeping the risk at caution rather than danger; the scope is limited to the Notion API surface.

Details

Evidence

SKILL.md: 'Notion:notion-create-pages', 'Notion:notion-update-page', 'Notion:notion-search', 'Notion:notion-fetch'
reference/database-best-practices.md: 'Notion:notion-create-database' — ability to create new databases in the workspace
README.md: MCP listed as 'notion — https://mcp.notion.com/mcp streamable_http' with no scope restrictions declared

MCP-000Medium

The MCP server points to `https://mcp.notion.com/mcp`, which is Notion's official hosted MCP endpoint — a known, legitimate service rather than an unknown or attacker-controlled binary.
No hidden instructions were found embedded in tool descriptions; the MCP definition is minimal (URL only, no suspicious parameters).
External host access is required for all operations, and the agent will transmit user conversation content to Notion's servers, which warrants caution but is consistent with the skill's stated purpose.

Details

Evidence

MCP config: `"notion": {"url": "https://mcp.notion.com/mcp"}`
SKILL.md workflow step 0: 'codex mcp add notion --url https://mcp.notion.com/mcp' — instructs adding the MCP if not present
No tool description fields with embedded instructions or unusual parameters observed in the MCP definition.