Notion 2025 API Skill

• Analyzed: May 11, 2026, 5:11 AM
• Findings: 1
• Version: 1.0.1
• Hash: 4b892b7d65335f04010dda092b824efe953e8a2f43c30169e35a5fdf9882923f
• Source: palm
• External report: View on VirusTotal

Findings (1)

This skill is designed for legitimate interaction with the Notion API. The `scripts/notion_helper.sh` script and the `SECURITY.md` file clearly indicate that a JSON injection vulnerability *existed* but has been *fixed* by implementing robust input validation and proper JSON escaping using `jq -Rs '.'` and `jq empty`. All network calls target the legitimate Notion API endpoint (`https://api.notion.com/v1/`). The documentation (SKILL.md, README.md) is transparent about API key handling and explicitly warns users about safe input practices. There is no evidence of malicious intent, data exfiltration, persistence mechanisms, or prompt injection attempts against the OpenClaw agent.