Gemini Deep Research → Notion

ReviewAudited by ClawScan on May 10, 2026.

Overview

The skill does what it claims, but it uses local Gemini/Notion account access and writes to a hard-coded Notion destination that is not declared in the registry metadata.

Install only if you are comfortable letting the agent use your Gemini browser session and Notion API token. Before running it, edit the Notion parent page ID to your own page, use a limited Notion integration token, and be aware the main session may be busy for about 25-30 minutes.

Findings (5)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The agent may use an existing local Notion token and logged-in browser session to submit research and create Notion pages, even though the registry metadata does not warn about those credentials.

Why it was flagged

The skill directly uses a local Notion API token to act on the user's Notion account, while the registry metadata declares no primary credential or required config path.

Skill content
Read the Notion API key: `cat ~/.config/notion/api_key`
Recommendation

Declare the Notion token/config path and Gemini login requirement in metadata, and use a least-privilege Notion integration shared only with the intended destination page.

What this means

Research results could be written to the wrong Notion page/workspace or fail unexpectedly unless the user edits the skill before use.

Why it was flagged

The skill creates Notion pages through the raw Notion API using a hard-coded parent page ID, so the destination is not clearly user-scoped at runtime.

Skill content
**Parent page ID:** `31a4cfb5-c92b-809f-9d8a-dd451718a017` ... `curl -s -X POST "https://api.notion.com/v1/pages"`
Recommendation

Require a user-provided Notion parent page ID in configuration and ask for confirmation before creating or appending Notion blocks.

What this means

Users may expect a non-blocking background workflow, but the actual skill can occupy the main session for about 25-30 minutes.

Why it was flagged

This conflicts with SKILL.md, which says all steps must run in the main session and explicitly not in a subagent.

Skill content
- 🤖 Runs as a subagent — non-blocking for main session
Recommendation

Align the README with SKILL.md and clearly state that the main session will be used for a long-running browser workflow.

What this means

Sensitive research topics or results may remain in a local temporary file after the Notion export.

Why it was flagged

The full generated report is stored locally, and the artifacts do not describe cleanup or retention.

Skill content
Save to a temp file: write full report to `/tmp/deep_research_<timestamp>.md`
Recommendation

Clean up temporary report files after successful export, or clearly document where they are stored and how users can delete them.

What this means

Reports will be generated in Chinese even if the user expected another language.

Why it was flagged

The skill changes every user query to force Chinese output, which may override the user's intended language.

Skill content
**Always prepend "请用中文回答。" to the query** so the research output is in Chinese.
Recommendation

Disclose this behavior in the description or ask the user which language to use.