Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
tool-save-to-notion
v1.0.0Automatically save any tool URL with extracted name, type, tags, description, and cover image as a structured entry in your Notion Toolbox database.
⭐ 0· 22·0 current·0 all-time
byAlex Redisread@redisread
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill's purpose (save tool links to Notion) aligns with the included Python script which fetches pages and calls the Notion API. However the registry metadata declares no required environment variables or primary credential while SKILL.md and the script both rely on a NOTION_API_KEY. This mismatch (metadata vs runtime needs) is incoherent and could cause surprises at runtime.
Instruction Scope
SKILL.md instructs the agent to fetch arbitrary user-provided URLs (via 'WebFetch') and to automatically run whenever any tool URL is given. The included script indeed performs HTTP GETs of the provided URL and extracts metadata. This behavior is coherent for the stated purpose, but the SKILL.md also references using Bash/curl and checking settings.json while the provided implementation is a Python script that reads NOTION_API_KEY from the environment—another inconsistency. Also the 'immediately use this skill whenever user provides ANY tool URL' trigger is broad and could result in frequent autonomous network fetches if the agent is allowed to invoke skills autonomously.
Install Mechanism
No install spec is provided (instruction + a script only). That minimizes install-time risk because nothing is downloaded at install. The script will run only when invoked. No suspicious download URLs or archive extraction are present.
Credentials
The only runtime secret the script uses is NOTION_API_KEY (which is appropriate for writing to Notion). That credential is proportional to the skill's purpose. The problem is that the registry metadata does not declare this required env var while SKILL.md and the script do—this inconsistency should be resolved before trusting the skill. SKILL.md also mentions settings.json and suggests curl/Bash usage, which the code does not use.
Persistence & Privilege
The skill does not request always:true and does not claim to change other skills or system-wide settings. Autonomous invocation is allowed by default for skills (disable-model-invocation is false) — that is normal, but combined with the broad trigger language in SKILL.md it increases the chance the skill will run frequently. The skill itself only performs web fetches and writes to the specified Notion database.
What to consider before installing
Key points to consider before installing:
- Metadata mismatch: The registry shows no required env vars, but the SKILL.md and scripts require NOTION_API_KEY. Confirm where you should put the Notion token and ensure the runtime will provide it securely (environment variable NOTION_API_KEY).
- Credential scope: Use a Notion integration token limited to only the specific database (6f7bb9cc-...) and minimal write scope. Do not supply a broader account token.
- Network fetches: The skill will fetch arbitrary user-provided URLs (HTTP GET) to extract metadata and images. If you run agents in a sensitive environment, be aware this can reach internal or private endpoints (SSRF risk). If needed, restrict outbound network access or sandbox the agent.
- Trigger behavior: SKILL.md's language to 'immediately use this skill' for any tool URL is broad. If you allow autonomous skill invocation, the agent may perform many fetches and Notion writes. Consider disabling autonomous invocation for this skill or confirming prompts that trigger it.
- Implementation inconsistencies: SKILL.md suggests using Bash/curl and settings.json, but the shipped code is a Python script that reads NOTION_API_KEY from the environment and uses urllib. Verify your runtime can execute the script and that the expected environment matches how you manage credentials.
- Verify Database ID and test safely: Confirm the provided database_id is the one you expect. Test with a throwaway Notion token and database to confirm behavior before giving production credentials.
If these issues are acceptable (provide the token as an env var, restrict token scope, and control when the skill is invoked), the skill's behavior appears coherent with its stated purpose. If any of the mismatches or the broad automatic-trigger wording worry you, treat the skill as untrusted until corrected.Like a lobster shell, security has layers — review code before you run it.
latestvk974d2rw62keb8yjbmn3xx4sc9848kcj
License
MIT-0
Free to use, modify, and redistribute. No attribution required.