Notion

运行要求

Runtime requirements📝 Clawdis

安全扫描

Security ScanVirusTotalVirusTotalBenignView report →OpenClawOpenClawSuspiciousmedium confidenceThe skill's instructions match a Notion API helper, but metadata omits the sensitive config path/credential it expects and the skill source is unknown — this mismatch and plaintext key guidance are concerning.Details ▾✓Purpose & CapabilityName/description match the SKILL.md: it documents how to call the Notion API to create/read/update pages, data sources, and blocks. The curl examples and Notion endpoints are coherent with the stated purpose.ℹInstruction ScopeThe runtime instructions explicitly tell the user/agent to store and read a Notion API key from ~/.config/notion/api_key and then use it in Authorization headers. That behavior is expected for a Notion integration, but the doc also gives an explicit plaintext storage pattern (echo into a file) which is risky — and the skill gives the agent direct shell-style commands to read that file.✓Install MechanismInstruction-only skill with no install spec and no code files — lowest install risk. Nothing is downloaded or written by an installer.!CredentialsRegistry metadata lists no required env vars, no primary credential, and no required config paths, yet SKILL.md both instructs creating an API key and reads a specific config file (~/.config/notion/api_key). That mismatch (credential/config use present in instructions but not declared in metadata) and the guidance to store the API key as plaintext are disproportionate and should be clarified.✓Persistence & Privilegealways:false and default autonomous invocation are normal. The skill does not request persistent system-level privileges. However, because the skill's instructions access a local key file, autonomous invocation combined with the undeclared credential is an additional risk to consider.What to consider before installingThis skill appears to be a straightforward Notion API helper, but the SKILL.md expects a Notion API key stored at ~/.config/notion/api_key while the registry metadata does not declare that config path or any primary credential. Before installing: (1) confirm the skill publisher/source (the skill lists an unknown source), (2) avoid storing keys as…