Notion Tasks Blocks

ReviewAudited by ClawScan on May 1, 2026.

Overview

The skill appears to do what it says—manage checklist blocks in one configured Notion page—but users should notice that it needs a Notion token and can make live Notion API changes.

This skill looks coherent for managing checklist blocks in Notion. Before installing, create or use a narrowly scoped Notion integration, share only the intended task page with it, set the correct NOTION_TASKS_PAGE_ID, and remember that add/done/undo commands will change that page.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Medium

#ASI03: Identity and Privilege Abuse

What this means

Anyone installing it must provide a Notion integration token that can read or modify pages shared with that integration.

Why it was flagged

The skill requires a Notion API token and a target page ID, which is expected for this Notion integration but gives the script delegated account/page access.

Skill content

- `NOTION_TOKEN` (`secret_...`)
- `NOTION_TASKS_PAGE_ID`

Recommendation

Use a dedicated Notion integration token with access only to the intended task page, and avoid sharing unrelated pages with that integration.

Low

#ASI02: Tool Misuse and Exploitation

What this means

If invoked with the wrong page ID or task text, it could add or change checklist items in the configured Notion page.

Why it was flagged

The script can PATCH the configured Notion page to add a to-do block, which is purpose-aligned but is still a live mutation of user data.

Skill content

request PATCH "$api/blocks/$NOTION_TASKS_PAGE_ID/children" "$payload"

Recommendation

Confirm the NOTION_TASKS_PAGE_ID value and review list output before marking tasks done or undone.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installation/setup may be less clear than the registry metadata suggests, and the user must ensure the local tools and token are configured intentionally.

Why it was flagged

The script requires environment variables and depends on curl and node, while the registry metadata declares no required env vars, credential, or binaries.

Skill content

: "${NOTION_TOKEN:?Missing NOTION_TOKEN}"
: "${NOTION_TASKS_PAGE_ID:?Missing NOTION_TASKS_PAGE_ID}"
...
curl -sS
...
node -e

Recommendation

Treat SKILL.md as the accurate setup guide, verify curl and node are available, and configure the Notion token deliberately.