Notion Sync Obsidian
v1.0.0自动将Notion文章同步到本地Obsidian目录,支持定时检查、完整内容导出、智能标题提取。
⭐ 1· 364·1 current·1 all-time
by@hawkvan
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill's name/description match the included scripts and behavior (sync Notion -> Obsidian). However the registry metadata declares no required environment variables or credentials while the SKILL.md, config.json and scripts all require a Notion API key (api_key) and an Obsidian root path. The omission of required credentials from metadata is an incoherence that reduces transparency.
Instruction Scope
SKILL.md instructs the agent/user to edit config.json and run the included scripts. The scripts only call Notion API endpoints (api.notion.com), write files into the configured Obsidian directory, manage a local PID/log file, and perform local debugging. They do not contact unknown/hidden external endpoints in the checked files. One caveat: some outputs and log writes include partial API/user info (e.g., printing first 10 chars of API key and API user/workspace), so secrets may be recorded in local logs/outputs.
Install Mechanism
There is no install spec (instruction-only install or manual copy). That keeps install risk low. The code bundle includes shell and Python scripts that will be written to disk when the skill is installed; those are visible and not obfuscated.
Credentials
The skill legitimately needs a Notion API key and an Obsidian path (both present in config.json). But the registry reported 'no required env vars' which is inconsistent. The skill expects the API key in config.json (a local file), and scripts echo and log API-related info (partial key, user/workspace), which could expose secrets in logs. The config file storage of a long-lived API key in the skill directory is reasonable for this use case but should be highlighted as sensitive.
Persistence & Privilege
The skill runs a background timer process (nohup + PID file) to perform periodic syncs. It does not require elevated system privileges and does not modify other skills. Running a persistent daemon is expected for a sync tool, but users should be aware it creates a long-running process under their account and writes log and PID files into the skill directory.
What to consider before installing
This skill appears to implement a legitimate Notion→Obsidian sync, but there are a few things to check before installing:
- Metadata mismatch: the registry claims no credentials required but the skill requires a Notion API token (api_key) in config.json. Expect to supply a long-lived Notion integration token and store it in the skill's config file.
- Secret handling: the scripts print and log API-related info (they display the first 10 chars of the API key and user/workspace names). Ensure the skill directory and log files (sync_timer.log) are protected (filesystem permissions) and not world-readable; consider removing the token after testing or using a least-privilege integration.
- Persistence: the skill launches a background process (nohup timer_checker.sh) and creates sync_timer.pid and sync_timer.log. Be prepared to manage/stop that process and review the log contents regularly.
- Code review: you can reasonably inspect the shipped scripts (they are plain shell/Python). The visible code only calls Notion API endpoints and writes to local disk — there are no hidden external endpoints in the provided files. However part of real_notion_checker.py was truncated in the provided listing; verify the rest of that file before trusting it fully to ensure it doesn't perform unexpected network calls or upload data elsewhere.
- Run in a safe environment first: if you're cautious, run the skill in a confined environment (container or dedicated user account) and use a Notion integration with minimal permissions.
If these checks are acceptable, the skill seems coherent with its stated purpose. If you need the registry to reflect required credentials, ask the maintainer to declare the Notion API key requirement in the skill metadata.Like a lobster shell, security has layers — review code before you run it.
latestvk9736dsd8fxwzf6r600qykcw6s81rpxh
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
📝 Clawdis
