Notion Mvp

Create and list Notion tasks in a single database via Notion API. Use when the user asks to add tasks, list today tasks, or capture quick todos in Notion fro...

Security Scan

The skill appears to implement a reasonable Notion integration, but the package metadata omits required environment variables and required binaries, which is an incoherence you should understand before installing.

Purpose & Capability

The skill's stated purpose (create/list Notion tasks) matches the included script: it calls api.notion.com using a NOTION_TOKEN and database IDs. However the registry metadata claims no required env vars or binaries, while SKILL.md and scripts require NOTION_TOKEN and either NOTION_DATABASE_MAP or NOTION_DATABASE_ID and also rely on external binaries (node, curl). The missing declarations in metadata are a discrepancy.

Instruction Scope

SKILL.md instructs the agent to run the bundled bash script which only uses NOTION_TOKEN, database IDs/map, and interacts with the Notion API. The runtime behavior is limited to querying Notion and constructing/creating pages; it does not read arbitrary files or other environment variables.

Install Mechanism

There is no install spec (instruction-only with an included script), so nothing is downloaded at install time. The script executes node and curl at runtime; the skill does not declare these required binaries in metadata, so the environment may be missing needed runtime dependencies.

Credentials

The environment variables used (NOTION_TOKEN, NOTION_DATABASE_MAP / NOTION_DATABASE_ID) are appropriate and proportional for a Notion integration. The concern is that the registry metadata lists no required credentials/env vars, so the skill's declared requirements do not match what it actually needs at runtime.

Persistence & Privilege

The skill does not request persistent 'always' privilege, does not modify other skills or system-wide settings, and does not store new credentials itself. Autonomous invocation is allowed (platform default) but not combined with other high-risk factors.

What to consider before installing

This script is largely coherent with a Notion task helper: it needs an integration token (NOTION_TOKEN) and either a NOTION_DATABASE_MAP (alias->database_id JSON) or a NOTION_DATABASE_ID fallback. Before installing: (1) be aware the registry metadata incorrectly claims no env vars or required binaries — you must provide NOTION_TOKEN and database IDs and have curl and node available. (2) Create a dedicated Notion integration with the minimum scopes needed (read/write pages) and share only the intended database(s) with that integration — do not reuse a full-account token. (3) Review the script (already included) to confirm it only calls api.notion.com and does not access other files; it does not attempt exfiltration beyond requests to Notion. (4) If you want stronger assurance, ask the publisher to fix the registry metadata to declare NOTION_TOKEN and the DB map and to note required binaries (node, curl). If you cannot verify the origin of the skill or do not want to provide a Notion token, do not install.

Use this skill to write/read tasks across multiple Notion databases (aliases).

Required env vars

• NOTION_TOKEN (integration token, secret_...)
• one of:
  • NOTION_DATABASE_MAP (JSON map alias -> database_id)
  • NOTION_DATABASE_ID (fallback default database)

Example NOTION_DATABASE_MAP:

{"agenda":"db_id_1","tarefas":"db_id_2","crm":"db_id_3"}

Command wrapper

Run:

bash {baseDir}/scripts/notion_mvp.sh <command> [args]

Commands:

• add <alias> "<bloco>" [YYYY-MM-DD] [HH:MM] ["<local>"] → create an item
  • defaults: data=today, hora=09:00, local=""
• today <alias> → list items with Data = today
• query <alias> "<text>" → search items by Bloco contains text
• aliases → list configured aliases

Expected database properties

This skill expects these Notion properties in each target database:

• Bloco (title)
• Data (rich_text/text)
• Hora (rich_text)
• Local (rich_text)

Usage pattern

1. Validate env vars and fail with clear message if missing.
2. Resolve the correct database alias (agenda, tarefas, etc.).
3. For schedule capture requests, call add with alias + Bloco/Data/Hora/Local.
4. For “hoje” / “today” requests, call today <alias>.
5. Return a concise summary after command output.

Examples

bash {baseDir}/scripts/notion_mvp.sh aliases
bash {baseDir}/scripts/notion_mvp.sh add agenda "Ligar para dermatologista" 2026-02-14 10:00 "Barra"
bash {baseDir}/scripts/notion_mvp.sh add tarefas "Consertar tela do celular" 2026-02-14 15:30 "Centro"
bash {baseDir}/scripts/notion_mvp.sh today agenda
bash {baseDir}/scripts/notion_mvp.sh query agenda "dermatologista"