Notion CLI – Command Line Interface based access to Notion for your agent
v1.0.0Access and manage your Notion workspace via a CLI to search, create, update, and delete pages, databases, blocks, users, and comments with multiple output fo...
⭐ 2· 2.8k·7 current·7 all-time
by@froemic
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill name and SKILL.md are consistent with a Notion CLI (operations and examples match the Notion API). However the registry metadata provides no description and does not declare the Notion API key (primary credential) even though the instructions explicitly require NOTION_API_KEY.
Instruction Scope
Runtime instructions are focused on Notion CLI usage and how to call the Notion API. They do not ask the agent to read unrelated system files, but they do recommend adding an API key into agent or shell env files (e.g., ~/.claude/.env or ~/.bashrc), which is expected for functionality but is a scope/handling decision the user should consider carefully.
Install Mechanism
There is no automated install spec in the registry; SKILL.md tells the user/agent to git clone a third‑party GitHub repository and run npm install/build/link. Cloning and building arbitrary third‑party code is potentially risky if done automatically — GitHub is a common host, but the skill does not declare that it will or will not perform this action itself.
Credentials
The instructions require NOTION_API_KEY (and optionally NOTION_DEBUG) but the skill metadata lists no required environment variables or primary credential. This mismatch is an incoherence: the skill needs a secret to function but does not declare it in its requirements, so a user/agent may not be aware of the credential scope ahead of time.
Persistence & Privilege
The skill is not marked always:true, declares no config paths to modify, and has no code in the package — it does not request elevated persistence or platform-wide privileges in the registry metadata.
What to consider before installing
This skill appears to be a wrapper for a third‑party Notion CLI and reasonably requires your Notion integration key, but the registry metadata omits that requirement and the SKILL.md instructs cloning and building a GitHub repo. Before installing or running these commands: 1) Verify the GitHub repository and review its code (npm install/build runs arbitrary JavaScript). 2) Prefer using the --api-key option for one-off runs rather than permanently storing the key in shell rc files, and create a scoped Notion integration with minimal permissions. 3) If you expect the skill to be self‑contained, ask the publisher why the registry metadata doesn't declare NOTION_API_KEY. 4) If you cannot or will not review the repo, consider using an official Notion SDK or a skill that explicitly declares required credentials and an install mechanism.Like a lobster shell, security has layers — review code before you run it.
latestvk97657ew8vzv7sr39vhp2x8hfx80n5jg
License
MIT-0
Free to use, modify, and redistribute. No attribution required.