Notion notion-cli — agentic threat model

Not certain from the listing — The specific foundation model driving the CLI generation is not disclosed. However, adversarial prompt injection is a major threat, as it could trick the model into generating destructive CLI commands.

Not certain from the listing — While the agent queries databases and uploads files, the internal data pipeline, caching, or vector storage mechanisms are not detailed. Key threats include unauthorized data exfiltration from Notion workspaces.

The agent framework translates user intent into ntn CLI commands. The primary threat is tool misuse and insecure tool integration, where the agent may execute unintended destructive commands (e.g., deleting pages or databases) due to planning errors or malicious inputs.

The agent runs the ntn binary and deploys workers. If the execution environment lacks strict sandboxing, running arbitrary CLI commands or deploying untrusted workers could lead to host compromise, privilege escalation, or unauthorized network access.

Not certain from the listing — There is no mention of guardrails, execution logging, or human-in-the-loop approval mechanisms to monitor and intercept risky CLI commands before they execute.

The agent requires access to the user's Notion API credentials to run the CLI. There is a high risk of credential exposure or abuse if access tokens are not securely stored and restricted to the minimum necessary scopes.

Not certain from the listing — No multi-agent or marketplace interactions are described, though the ability to deploy workers introduces potential downstream ecosystem risks if those workers interact with external APIs.