Back to skill
Skillv2.0.0
ClawScan security
Notion Template · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 17, 2026, 6:50 PM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's files, runtime instructions, and local filesystem behavior match its stated purpose (generating Notion templates); it does not request credentials or contact external services.
- Guidance
- This skill appears to do what it says: generate Notion-importable Markdown templates. It does not contact external services or ask for credentials. Before running, review the scripts if you want to confirm behavior. Note the utility creates and writes files by default under $NOTION_TEMPLATE_DIR (or $XDG_DATA_HOME/notion-template or $HOME/.local/share/notion-template) — history.log and data.log will be appended there. If you prefer another location, set NOTION_TEMPLATE_DIR to a safe folder. As always, avoid running unreviewed scripts with elevated privileges.
Review Dimensions
- Purpose & Capability
- okName/description (Notion template generator) align with the provided files and scripts. scripts/notion.sh prints workspace/database/dashboard/wiki/project/personal templates in Markdown as advertised. There are no unrelated binaries, cloud credentials, or external services required.
- Instruction Scope
- okSKILL.md advises running bash scripts/notion.sh with a command and parameters; that matches the actual script behavior. The scripts only generate Markdown output and local logs; they do not read unrelated system files or network endpoints. The scripts reference standard env vars (NOTION_TEMPLATE_DIR, XDG_DATA_HOME, HOME) which are reasonable for controlling where data is written.
- Install Mechanism
- okNo install spec or remote downloads; this is instruction-only with bundled shell scripts. Nothing is fetched from external URLs and no archives are extracted, so install risk is low.
- Credentials
- okThe skill declares no required env vars or secrets. scripts/script.sh optionally respects NOTION_TEMPLATE_DIR and XDG_DATA_HOME for data placement—these are proportional to storing local state. There are no requests for TOKEN/KEY/PASSWORD variables or other service credentials.
- Persistence & Privilege
- noteThe skill is not forced-always and permits user invocation. The included utility creates a data directory by default (~/.local/share/notion-template) and appends to data.log and history.log there. Writing local files is expected for a utility but users should be aware of the default storage location.