heating the forge...

@forgecat/openai_skills_notion-spec-to-implementation — Security Risk Report | ForgeCat

openai_skills_notion-spec-to-implementation

Security risk report for @forgecat/openai_skills_notion-spec-to-implementation v0.0.10

Low

Profile sourced from OpenAI's official skills repository (github.com/openai/skills).
Declared author is OpenAI; version and commit hash provided for traceability.
No typosquatted, attacker-controlled, or suspicious package dependencies declared.

Low

Content describes legitimate workflow for parsing specs, creating implementation plans, and tracking progress in Notion.
No instructions to ignore system prompts, read credentials, exfiltrate data, or execute remote payloads.
References to external URLs (Notion MCP, GitHub banner) are for documentation and setup—not malicious injection or guidance poisoning.

Details

Findings

Invisible characters detected
skills/notion-spec-to-implementation/reference/spec-parsing.md · SKILL-011

Evidence

Workflow steps are procedural (search → fetch → parse → create → link → track).
Task templates and examples show standard project management patterns.
No hidden instructions, role hijacking, or attempts to weaken security defaults.

Low

Skill uses Notion MCP tools (notion-search, notion-fetch, notion-create-pages, notion-update-page) scoped to Notion workspace operations.
No shell, file_write, file_delete, or arbitrary code execution permissions requested.
Authority matches stated purpose: reading specs, creating/updating Notion pages, linking tasks.

Details

Evidence

MCP-000Medium

The Notion MCP server (https://mcp.notion.com/mcp) is an official Notion-hosted endpoint, which is a known and legitimate service, reducing supply-chain risk.
The MCP grants read and write access to the user's entire connected Notion workspace, which is broader than a narrowly scoped integration — any page or database the OAuth token can reach is accessible.
No hidden instructions were found in tool descriptions, and no arbitrary binary execution or unrestricted filesystem access is involved.

Details

Evidence

MCP config: '"notion": {"url": "https://mcp.notion.com/mcp"}' — official Notion endpoint, streamable HTTP
SKILL.md: uses Notion:notion-search, Notion:notion-fetch, Notion:notion-create-pages, Notion:notion-update-page — broad workspace read/write scope
No tool description fields with embedded instructions or unknown binaries detected