Diy Pc Ingest

ReviewAudited by ClawScan on May 10, 2026.

Overview

This is a coherent Notion importer for PC-parts records, but it needs a Notion token and can create, update, overwrite, or archive records in the configured Notion tables.

Before installing, make sure you are comfortable letting the skill write to Notion. Use a dedicated least-privilege Notion integration connected only to the DIY_PC tables, keep the token out of shared configs, and review any generated records that use page_id, overwrite, or archive.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Medium

#ASI03: Identity and Privilege Abuse

What this means

The skill can read and modify Notion resources shared with the integration token.

Why it was flagged

The skill requires a Notion credential and can act with whatever workspace/database access that integration token has. This is expected for the stated Notion-ingest purpose, but users should scope the token carefully.

Skill content

Provide a Notion integration token (choose one):
- env: `NOTION_API_KEY` (recommended)
- or `~/.config/notion/api_key` (legacy local path)
- or inline `notion.api_key` in `config.json`

Recommendation

Use a dedicated Notion integration shared only with the intended DIY_PC databases, prefer NOTION_API_KEY over storing tokens in files, and rotate the token if it is exposed.

Medium

#ASI02: Tool Misuse and Exploitation

What this means

A mistaken or overly broad record could change or archive Notion content instead of only filling missing PC inventory fields.

Why it was flagged

The apply script supports direct page updates, overwrites, and archiving. These controls are disclosed and related to cleanup/manual fixes, but they are more powerful than the normal safe upsert path.

Skill content

Optional control fields (for cleanup / manual fixes):
- `page_id` (or `id`): update this Notion page directly (bypasses upsert matching)
- `archive: true`: archive the page
- `overwrite: true`: allow overwriting existing values (including clearing with null)

Recommendation

Review generated JSONL before using page_id, overwrite, or archive, and reserve those controls for explicit manual cleanup tasks.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installers relying only on registry metadata may not realize a Notion token is needed until reading the skill documentation.

Why it was flagged

Registry metadata under-declares the Notion credential that the SKILL.md and scripts clearly require. This is a metadata completeness issue rather than hidden behavior because the documentation discloses the token setup.

Skill content

Required env vars: none
Env var declarations: none
Primary credential: none

Recommendation

Treat the Notion token as a required credential for use, and update metadata if publishing or redistributing the skill.