Notion Openapi Skill

This skill appears to be a legitimate Notion/OpenAPI wrapper, but double-check a few things before installing or providing secrets: - Declare and use a dedicated Notion integration token (NOTION_API_TOKEN) rather than a shared or high-privilege token. The skill needs this token to work; the registry metadata omits that, so don't assume it won't need one. - The SKILL.md recommends reusing an OAuth credential (notion-mcp). Reusing credentials can cause headers (Notion-Version, Authorization) to be sent to other endpoints (mcp.notion.com). Only reuse if you understand and accept that cross-host header behavior. - The repository includes a validation script that expects jq and ripgrep (rg). Those binaries are not declared in the skill metadata — this is a minor transparency gap but not necessarily dangerous. - Ensure you trust the 'uxc' CLI/tool referenced here; it is central to how this skill issues requests and manages credentials. If you don't control uxc, inspect its configuration and behavior before binding credentials. If the owner can update the registry metadata to list NOTION_API_TOKEN (or declare the primary credential) and any required helper binaries, and more clearly warn about header leakage when reusing credentials, that would resolve the main concerns.