Security risk report for @forgecat/openai_skills_notion-meeting-intelligence v0.0.11
Source Integrity
Low
Profile is sourced from OpenAI's official skills repository (github.com/openai/skills) with documented commit hash and MIT license.
ForgeCat installation and MCP discovery are standard, transparent mechanisms; no hidden or obfuscated supply-chain risks detected.
Agent Intent
Low
Content describes legitimate meeting-preparation workflows (gathering Notion context, drafting agendas, enriching with research) with no instructions to manipulate the AI, exfiltrate data, or bypass security controls.
Examples and templates are instructional documentation for the skill's intended use; they do not plant malicious guidance, weaken security defaults, or instruct the agent to hide its instructions or reveal system prompts.
Workflow steps (search Notion, fetch pages, create documents, enrich with Codex research) are transparent and aligned with the stated purpose of preparing meeting materials.
Details
Evidence
SKILL.md Step 0 correctly instructs the agent to pause and set up Notion MCP if it fails, rather than silently proceeding or exfiltrating data.
Examples (customer-meeting.md, executive-review.md, project-decision.md) show proper use of Notion:notion-search, Notion:notion-fetch, and Notion:notion-create-pages with no hidden exfiltration or credential-reading instructions.
Templates (decision-meeting-template.md, status-update-template.md, etc.) are standard meeting structures with no embedded malicious directives or guidance poisoning.
Permissions
PRM-000Medium
Skill declares use of Notion MCP tools (notion-search, notion-fetch, notion-create-pages, notion-update-page) which grant read and write access to a user's Notion workspace—a medium-risk category (web_fetch, subagent-like external service access).
Authority is reasonably scoped to the stated function (gathering meeting context and creating/updating meeting documents in Notion), but write access to arbitrary Notion pages could be misused if the skill were compromised or manipulated.
No shell, file_write, or file_delete permissions declared; no alwaysApply=true rules with broad globs.
Details
Evidence
SKILL.md references Notion:notion-search, Notion:notion-fetch, Notion:notion-create-pages, Notion:notion-update-page without explicit permission declarations in the profile.
Examples show creation and updates to Notion pages (e.g., 'Notion:notion-create-pages' in customer-meeting.md, project-decision.md), which require write access to the workspace.
No evidence of excessive authority beyond Notion workspace access; no shell commands, file system mutations, or unrestricted network calls.
MCP Risk
MCP-000Medium
Notion MCP server is accessed via HTTP at https://mcp.notion.com/mcp, which requires external network access and OAuth credentials; this is a known third-party service but introduces a dependency on external infrastructure.
Profile correctly documents that OAuth authorization is required and that authentication-boundary checks do not automatically connect a Notion workspace; users must explicitly log in via 'codex mcp login notion'.
No hidden instructions in tool descriptions; Notion MCP is a legitimate, documented service. However, the HTTP endpoint and credential requirement represent medium-level supply-chain and operational risk.
Details
Evidence
README.md states: 'The Notion MCP endpoint requires OAuth authorization before it can read or write pages.'
MCP server definition specifies only the Notion endpoint (https://mcp.notion.com/mcp) with no additional suspicious binaries, unrestricted filesystem, or arbitrary command execution.
ForgeCat