hocnhanh_n8n

Notion API for creating and managing pages, databases, and blocks.

Security Scan

This is an instruction-only Notion integration that reasonably asks for a single Notion API key and provides curl examples — overall coherent, with minor inconsistencies around how the key is stored/referenced.

Purpose & Capability

Name/description (Notion API for pages/databases/blocks) match the runtime instructions which only call api.notion.com endpoints. No unrelated services, binaries, or excessive capabilities are requested.

Instruction Scope

SKILL.md instructs the user to store the key in ~/.config/notion/api_key and shows reading it into NOTION_KEY with cat, but the skill metadata declares NOTION_API_KEY as the required env var and lists no required config paths. The instructions therefore reference a config path that the registry metadata did not declare and use a different env-var name (NOTION_KEY) than the declared primary (NOTION_API_KEY). Also recommends storing the secret as plain text in the home directory (common but worth noting).

Install Mechanism

No install spec or code files; this is instruction-only, so nothing will be downloaded or written to disk by an installer.

Credentials

Only one credential (Notion API key) is requested, which is proportional to the stated purpose. Minor inconsistency: metadata expects NOTION_API_KEY while examples use NOTION_KEY and a file at ~/.config/notion/api_key — the single credential is appropriate but the handling is ambiguous.

Persistence & Privilege

always is false and the skill does not request persistent system-wide configuration or other skills' credentials. Autonomous invocation is allowed (platform default) but not combined with any broad or unrelated privileges here.

Assessment

This skill appears to do what it claims: call the Notion API using a Notion integration key. Before installing, note two small issues: (1) the registry metadata declares NOTION_API_KEY as the primary credential but the SKILL.md examples use a different variable name (NOTION_KEY) and instruct you to store the key in ~/.config/notion/api_key — decide whether you'll provide the key via env var or file and adjust accordingly; (2) the instructions recommend storing the API key as plain text in your home directory — consider using your platform's secret storage or environment variables instead, and give the integration only the minimum scopes and page/database access required. If you proceed, verify the integration name and scope in Notion and be ready to revoke the key if you notice unexpected activity.

notion

Use the Notion API to create/read/update pages, data sources (databases), and blocks.

Setup

1. Create an integration at https://notion.so/my-integrations
2. Copy the API key (starts with ntn_ or secret_)
3. Store it:

mkdir -p ~/.config/notion
echo "ntn_your_key_here" > ~/.config/notion/api_key

4. Share target pages/databases with your integration (click "..." → "Connect to" → your integration name)

API Basics

All requests need:

NOTION_KEY=$(cat ~/.config/notion/api_key)
curl -X GET "https://api.notion.com/v1/..." \
  -H "Authorization: Bearer $NOTION_KEY" \
  -H "Notion-Version: 2025-09-03" \
  -H "Content-Type: application/json"

Note: The Notion-Version header is required. This skill uses 2025-09-03 (latest). In this version, databases are called "data sources" in the API.

Common Operations

Search for pages and data sources:

curl -X POST "https://api.notion.com/v1/search" \
  -H "Authorization: Bearer $NOTION_KEY" \
  -H "Notion-Version: 2025-09-03" \
  -H "Content-Type: application/json" \
  -d '{"query": "page title"}'

Get page:

curl "https://api.notion.com/v1/pages/{page_id}" \
  -H "Authorization: Bearer $NOTION_KEY" \
  -H "Notion-Version: 2025-09-03"

Get page content (blocks):

curl "https://api.notion.com/v1/blocks/{page_id}/children" \
  -H "Authorization: Bearer $NOTION_KEY" \
  -H "Notion-Version: 2025-09-03"

Create page in a data source:

curl -X POST "https://api.notion.com/v1/pages" \
  -H "Authorization: Bearer $NOTION_KEY" \
  -H "Notion-Version: 2025-09-03" \
  -H "Content-Type: application/json" \
  -d '{
    "parent": {"database_id": "xxx"},
    "properties": {
      "Name": {"title": [{"text": {"content": "New Item"}}]},
      "Status": {"select": {"name": "Todo"}}
    }
  }'

Query a data source (database):

curl -X POST "https://api.notion.com/v1/data_sources/{data_source_id}/query" \
  -H "Authorization: Bearer $NOTION_KEY" \
  -H "Notion-Version: 2025-09-03" \
  -H "Content-Type: application/json" \
  -d '{
    "filter": {"property": "Status", "select": {"equals": "Active"}},
    "sorts": [{"property": "Date", "direction": "descending"}]
  }'

Create a data source (database):

curl -X POST "https://api.notion.com/v1/data_sources" \
  -H "Authorization: Bearer $NOTION_KEY" \
  -H "Notion-Version: 2025-09-03" \
  -H "Content-Type: application/json" \
  -d '{
    "parent": {"page_id": "xxx"},
    "title": [{"text": {"content": "My Database"}}],
    "properties": {
      "Name": {"title": {}},
      "Status": {"select": {"options": [{"name": "Todo"}, {"name": "Done"}]}},
      "Date": {"date": {}}
    }
  }'

Update page properties:

curl -X PATCH "https://api.notion.com/v1/pages/{page_id}" \
  -H "Authorization: Bearer $NOTION_KEY" \
  -H "Notion-Version: 2025-09-03" \
  -H "Content-Type: application/json" \
  -d '{"properties": {"Status": {"select": {"name": "Done"}}}}'

Add blocks to page:

curl -X PATCH "https://api.notion.com/v1/blocks/{page_id}/children" \
  -H "Authorization: Bearer $NOTION_KEY" \
  -H "Notion-Version: 2025-09-03" \
  -H "Content-Type: application/json" \
  -d '{
    "children": [
      {"object": "block", "type": "paragraph", "paragraph": {"rich_text": [{"text": {"content": "Hello"}}]}}
    ]
  }'

Property Types

Common property formats for database items:

• Title: {"title": [{"text": {"content": "..."}}]}
• Rich text: {"rich_text": [{"text": {"content": "..."}}]}
• Select: {"select": {"name": "Option"}}
• Multi-select: {"multi_select": [{"name": "A"}, {"name": "B"}]}
• Date: {"date": {"start": "2024-01-15", "end": "2024-01-16"}}
• Checkbox: {"checkbox": true}
• Number: {"number": 42}
• URL: {"url": "https://..."}
• Email: {"email": "[e-mail]"}
• Relation: {"relation": [{"id": "page_id"}]}

Key Differences in 2025-09-03

• Databases → Data Sources: Use /data_sources/ endpoints for queries and retrieval
• Two IDs: Each database now has both a database_id and a data_source_id
  • Use database_id when creating pages (parent: {"database_id": "..."})
  • Use data_source_id when querying (POST /v1/data_sources/{id}/query)
• Search results: Databases return as "object": "data_source" with their data_source_id
• Parent in responses: Pages show parent.data_source_id alongside parent.database_id
• Finding the data_source_id: Search for the database, or call GET /v1/data_sources/{data_source_id}

Notes

• Page/database IDs are UUIDs (with or without dashes)
• The API cannot set database view filters — that's UI-only
• Rate limit: ~3 requests/second average, with 429 rate_limited responses using Retry-After
• Append block children: up to 100 children per request, up to two levels of nesting in a single append request
• Payload size limits: up to 1000 block elements and 500KB overall
• Use is_inline: true when creating data sources to embed them in pages