Shopee to Notion Sync

Sync Shopee products into Notion using the local Node.js workflow only.

This skill's behavior generally matches its name — it calls the Shopee affiliate GraphQL endpoint and the Notion API to create/update pages. Before installing or running it: - Treat the registry metadata as incomplete: the script requires SHOPEE_APP_ID, SHOPEE_SECRET, NOTION_TOKEN, and NOTION_DATABASE_ID (put them into a dedicated env file or export them at runtime). - Inspect the .env file at /data/.openclaw/workspace-sales/.env (or change jobs/config.js) — the script will load that exact path, which could expose other workspace secrets; run the skill in an isolated workspace or modify config.js to use a skill-local .env or explicit env vars. - Verify the Notion token's scope (least privilege) and the Shopee credentials before granting them. - Run npm install in a controlled environment and review the dependencies (axios, dotenv are expected). If you want higher assurance, ask the author to: (a) declare required env vars in the registry metadata, (b) remove the hard-coded absolute dotenv path or make it configurable, and (c) document exactly what is stored in the workspace .env so you can confirm no unrelated secrets will be read.

Type: OpenClaw Skill Name: shopee-to-notion-sync Version: 1.0.0 The skill facilitates syncing Shopee products to Notion via a Node.js script, but it contains a vulnerability in jobs/shopee-client.js where the search keyword is directly interpolated into a GraphQL query string without sanitization, allowing for potential GraphQL injection. Additionally, the command template provided in SKILL.md (node jobs/sync-shopee-notion.js "<keyword>" ...) presents a shell injection risk if the AI agent fails to properly escape user-provided input. While the code appears to be a legitimate integration and lacks evidence of intentional malice or data exfiltration, these security flaws meet the criteria for a suspicious classification.