Notion Tasks Blocks

Manage Notion checklist blocks inside a page (no database required). Use when the user has plain to-do blocks and wants to list tasks, add tasks, and mark ta...

Security Scan

The skill's behavior (calls to Notion API using NOTION_TOKEN and a page ID, plus reliance on node/curl) matches its Notion checklist purpose, but the package metadata fails to declare required environment variables and binaries — an incoherence that should be fixed or explained before install.

Purpose & Capability

The script implements listing/adding/checking Notion to_do blocks via api.notion.com which aligns with the skill name and description. However the registry/manifest claims no required env vars or binaries while the SKILL.md and script require NOTION_TOKEN and NOTION_TASKS_PAGE_ID (and runtime tools like node and curl). The declared metadata is incomplete.

Instruction Scope

SKILL.md instructs only Notion-related actions (list/add/done/undo) and the script sends requests only to api.notion.com. The instructions and script do not read unrelated files, call other endpoints, or access extra environment variables.

Install Mechanism

No install spec (instruction-only with an included script) — low install risk. Nothing is downloaded from third-party URLs and no archives are extracted. However the script relies on node for JSON handling; this dependency is not declared in the registry metadata.

Credentials

The runtime requires NOTION_TOKEN and NOTION_TASKS_PAGE_ID which are appropriate for Notion API access, but the registry lists no required env vars. Also NOTION_TOKEN is a secret-like credential and users should ensure it has minimal scopes and is only granted to the relevant page/integration.

Persistence & Privilege

The skill does not request always:true, does not modify other skills or system settings, and will only act when invoked. It does perform API calls under provided credentials, which is expected for this purpose.

What to consider before installing

This skill's code appears to do only Notion API operations (list/add/mark tasks), which is consistent with its description — but the registry metadata is incomplete. Before installing: 1) Confirm you will provide NOTION_TOKEN and NOTION_TASKS_PAGE_ID (the SKILL.md requires them). 2) Ensure Node and curl are available in the runtime (the script calls node -e). 3) Use a Notion integration token with the minimal scopes and only share the specific page with that integration; avoid supplying broader organization tokens. 4) Ask the skill author or registry to update the metadata to declare the required env vars and binaries (this mismatch is the main coherence problem). 5) Inspect the script yourself (it is included) and only proceed if you are comfortable with the token being used to call api.notion.com; rotate the token after testing if you are concerned.

Use this skill for Notion pages that contain to_do blocks (checklist items), not databases.

Required env vars

• NOTION_TOKEN (secret_...)
• NOTION_TASKS_PAGE_ID (page id that contains the task blocks)

Command wrapper

bash {baseDir}/scripts/notion_tasks_blocks.sh <command> [args]

Commands:

• list → list current to-do blocks with index and done status
• add "<text>" → append new unchecked to-do block to the page
• done <index> → mark indexed task as checked
• undo <index> → mark indexed task as unchecked

Notes

• Indexes come from list.
• Works only for top-level to_do blocks on the page.
• If Notion returns permission errors, share the page with your integration.