GitHub Stars Export

Export GitHub starred repositories by category and sync them to a Notion database.

Security Scan

The skill mostly does what it claims (export GitHub stars and sync to Notion), but there are inconsistencies in declared requirements and some risky behaviors (notably disabling TLS verification) that merit caution before installing.

Purpose & Capability

The code and docs implement exporting GitHub starred repos (via gh) and syncing to Notion (via NOTION_API_KEY + requests), which matches the skill's stated purpose. However the top-level registry metadata claimed no required env vars or binaries while agent.yaml and SKILL.md require NOTION_API_KEY, gh, and jq — an internal inconsistency that should be resolved.

Instruction Scope

Runtime instructions are limited to running the included scripts and using local files, which is appropriate. However the Python script disables TLS verification on all Notion API calls (requests.* with verify=False and urllib3 warnings suppressed), which weakens transport security and could enable MITM of sensitive tokens. The references/README also claim a hardcoded fallback Notion key exists if the env var is not set, but the actual script shown does not contain such a fallback — another inconsistency in docs vs code.

Install Mechanism

No install spec is provided and this is an instruction + script bundle, so nothing is automatically downloaded or executed outside the repo. That's lower risk. Note: agent.yaml lists runtime dependencies (gh, jq, requests) that must be present; there is no automatic installer here.

Credentials

The skill needs a Notion API key and the GitHub CLI to function, which is proportional to its purpose. However the registry metadata at the top declared 'Required env vars: none' while agent.yaml and SKILL.md require NOTION_API_KEY — an outright mismatch. The script will read NOTION_API_KEY from the environment and will include it in Authorization headers, so the user must be sure they trust the code before providing that token.

Persistence & Privilege

The skill writes local state to assets/.notion_sync_config.json and creates/updates a Notion database via the API. It does not declare always:true, does not modify other skills, and does not request elevated system privileges. Local state and config file usage is normal for this kind of tool.

What to consider before installing

This skill largely matches its stated purpose, but review a few things before installing: 1) Confirm NOTION_API_KEY will be required (agent.yaml and SKILL.md require it even though top-level metadata omitted it). Provide only a token with minimal scopes. 2) The Python script disables TLS verification (verify=False) for all Notion API calls — this reduces transport security and is a real risk for token exposure (consider editing the script to remove verify=False). 3) Ensure you have gh authenticated and jq installed locally before running export_stars.sh. 4) Inspect and test the scripts locally (they write assets/.notion_sync_config.json and create/modify a Notion database under a hardcoded default parent page ID) in a controlled environment before giving any secrets. 5) If the README/reference claim of a hardcoded fallback API key matters to you, ask the author for clarification — that claim does not appear in the shown script. If you need higher assurance, request the author to fix the metadata inconsistencies and remove verify=False.

GitHub Stars to Notion Sync Skill

This skill allows you to automate the process of exporting your GitHub starred repositories (grouped by custom lists/categories) and syncing them into a structured Notion database.

Instructions

When this skill is active, you can perform the following tasks:

1. Export GitHub Stars

Use the shell script in ./scripts/export_stars.sh to fetch all starred repositories and save them to ./assets/starred_lists.md.

• Requirement: GitHub CLI (gh) must be installed and authenticated.
• Output: A Markdown file with tables for each category.

2. Sync to Notion

Use the Python script in ./scripts/sync_stars_to_notion_db.py to parse the exported Markdown and populate a Notion database.

• Requirement: NOTION_API_KEY environment variable must be set.
• Requirement: requests library must be installed.
• Config: Local state is tracked in ./assets/.notion_sync_config.json.

3. Workflow

1. Run ./scripts/export_stars.sh.
2. Run python scripts/sync_stars_to_notion_db.py.

Tool Definitions

• export_stars: Fetches GitHub stars and updates ./assets/starred_lists.md.
• sync_to_notion: Syncs the contents of ./assets/starred_lists.md to Notion.