Security risk report for @forgecat/openai_skills_notion-research-documentation v0.0.11
Source Integrity
Low
Profile is attributed to OpenAI with a public GitHub repository link (https://github.com/openai/skills) and MIT license, indicating a legitimate open-source origin.
The MCP server endpoint (https://mcp.notion.com/mcp) is a known, official Notion service.
No evidence of typosquatted packages, attacker-controlled dependencies, or supply-chain manipulation.
Agent Intent
Low
The profile describes a legitimate research and documentation workflow using Notion APIs; it does not instruct the agent to ignore instructions, exfiltrate data, or perform malicious actions.
References to MCP setup (e.g., 'codex mcp add notion') are standard configuration guidance, not hidden manipulation or prompt injection.
The skill teaches proper citation practices and source attribution, reinforcing transparency rather than deception or system-prompt leakage.
Details
Evidence
Workflow section 0 instructs: 'If any MCP call fails because Notion MCP is not connected, pause and set it up' — transparent, user-facing guidance.
Citations section explicitly requires: 'Every key claim has a source citation' and 'All page mentions have valid URLs' — promotes accountability.
No instructions to read ~/.ssh, ~/.aws, .env, or exfiltrate environment variables; no role-hijacking language.
Permissions
PRM-000Medium
The profile connects to an external HTTP MCP server (mcp.notion.com) and instructs the agent to read, create, and update Notion pages, which constitutes web_fetch and write authority over a third-party service.
This authority is consistent with the stated purpose (Notion research and documentation), so it is not excessive in intent, but it does require OAuth credentials and grants broad read/write access to the user's entire Notion workspace.
No shell, local file_write, or file_delete tools are declared, keeping the footprint contained to the Notion integration.
README.md: 'The Notion MCP endpoint requires OAuth authorization before it can read or write pages.'
MCP Risk
Low
The Notion MCP server is a known, official service (mcp.notion.com) with no hidden instructions or arbitrary binary execution.
Access is scoped to Notion workspace operations via OAuth; no unrestricted filesystem or network access.
The profile explicitly documents the authentication boundary and notes that 'Authentication-boundary checks do not connect a Notion workspace or verify document operations,' indicating awareness of security boundaries.
Details
Evidence
MCP server URL is official Notion domain: 'https://mcp.notion.com/mcp'.
ForgeCat