ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Notion Sync

v0.1.0

Sync local workspace directories and files to Notion pages using the notion-sync CLI or programmatic API. Use when the user wants to push files to Notion, mi...

⭐ 0· 531·0 current·0 all-time
by@kitakitsune0x
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description, CLI flags, SKILL.md, and source files all consistently implement a Notion syncing tool. Dependencies (@notionhq/client, glob, ignore, etc.) are appropriate for this functionality. No unrelated credentials, binaries, or platform access are requested.
ℹ
Instruction Scope
Runtime instructions and code operate on the target directory and Notion via the provided token. They do not read unrelated system files or env vars. Important behavioral note: updating a file will cause the tool to clear existing blocks on the corresponding Notion page and re-append content (destructive-within-Notion behavior). SKILL.md documents usage and init flow; nothing unexpected is being transmitted to external endpoints other than Notion's API.
✓
Install Mechanism
This is an instruction-only skill with source included; SKILL.md recommends installing from npm (registry). There is no remote arbitrary download URL or archive extraction in the skill metadata. package.json and package-lock.json show normal npm dependencies.
ℹ
Credentials
No environment variables are required by the skill metadata. The tool requires a Notion token provided at init and stores it in plaintext inside .notion-sync.json in the project root. The default ignore set includes '.notion-sync.json' (so the config should be ignored by git by default), but if committed the token could be exposed. The tool needs readonly/write access to the specified directory and write access in Notion — both are expected for the stated purpose.
✓
Persistence & Privilege
always is false and the skill does not request persistent presence or modify other skills or global agent settings. It writes its own .notion-sync.json config in the user's project directory (expected behavior).
Assessment
This skill appears to do what it says: mirror a local directory to Notion. Before using it, (1) create a Notion integration with the minimum scopes needed and use that token; (2) keep the generated .notion-sync.json out of version control (the default ignore list already includes it, but double-check your repo’s .gitignore) because it contains the token in plaintext; (3) run sync with --dry-run or --diff first to preview changes; (4) be aware that updates clear and re-append page blocks, which can overwrite existing content in the target Notion pages—test on a dedicated root page or a small sample directory first; and (5) review the token and page sharing settings in Notion so the integration only has access to the intended pages.

Like a lobster shell, security has layers — review code before you run it.

latestvk972zrkryxy93gqmbfj7s2sve581k1h9

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments