Security risk report for @forgecat/openai_skills_notion-spec-to-implementation v0.0.11
Source Integrity
Low
Profile sourced from OpenAI's official skills repository (github.com/openai/skills) with documented commit hash.
MIT license and clear attribution to original author.
No typosquatted, attacker-controlled, or suspicious package dependencies declared.
Agent Intent
Low
Content describes legitimate workflow for parsing specs and creating implementation plans—no instructions to ignore system prompts, exfiltrate data, or manipulate the AI.
Reference documentation (spec-parsing.md, task-creation.md, etc.) teaches best practices for requirement extraction and task breakdown; no guidance poisoning or malicious knowledge injection.
Examples (api-feature.md, database-migration.md, ui-component.md) demonstrate proper use of Notion MCP tools for legitimate project management; no hidden instructions to weaken security or install backdoors.
SKILL.md workflow is straightforward: search spec → fetch → parse → create plan → create tasks → track progress.
spec-parsing.md teaches extraction patterns and ambiguity handling; no instruction to bypass authentication or leak system state.
Examples show standard Notion API calls (notion-search, notion-fetch, notion-create-pages, notion-update-page) with no exfiltration or privilege escalation.
Permissions
Low
Skill declares only Notion MCP server (http://mcp.notion.com/mcp) for legitimate document read/write operations aligned with stated purpose.
No shell, file_write, file_delete, or other high-risk tool categories declared.
Authority is scoped to Notion workspace operations (search, fetch, create, update pages) necessary for spec-to-implementation workflow.
Details
Evidence
MCP server table lists only 'notion' with http transport to mcp.notion.com.
SKILL.md workflow uses only Notion:notion-search, Notion:notion-fetch, Notion:notion-create-pages, Notion:notion-update-page—all read/write operations on Notion documents.
No alwaysApply rules, globs='**', or unrestricted filesystem/network access declared.
MCP Risk
MCP-000Medium
Notion MCP server requires OAuth authorization; profile correctly documents authentication boundary and that actual document operations require separate authenticated verification.
External HTTP endpoint (mcp.notion.com) introduces network dependency; however, this is a known, legitimate Notion service.
Profile does not deliver MCP connection setup for OpenClaw/Hermes platforms (marked Partial), reducing attack surface on those platforms.
Details
Evidence
README.md states: 'The Notion MCP endpoint requires OAuth authorization before it can read or write pages.'
Setup instructions (SKILL.md Step 0) require explicit user action: 'codex mcp add notion --url https://mcp.notion.com/mcp' and 'codex mcp login notion'.
MCP server definition is minimal: only URL and transport type; no hidden instructions in tool descriptions or arbitrary binary execution.
ForgeCat