Notion Openapi Skill

Operate Notion Public API through UXC with a curated OpenAPI schema for search, block traversal, page reads, content writes, and data source/database inspect...

This skill appears to be a legitimate Notion/OpenAPI wrapper, but double-check a few things before installing or providing secrets: - Declare and use a dedicated Notion integration token (NOTION_API_TOKEN) rather than a shared or high-privilege token. The skill needs this token to work; the registry metadata omits that, so don't assume it won't need one. - The SKILL.md recommends reusing an OAuth credential (notion-mcp). Reusing credentials can cause headers (Notion-Version, Authorization) to be sent to other endpoints (mcp.notion.com). Only reuse if you understand and accept that cross-host header behavior. - The repository includes a validation script that expects jq and ripgrep (rg). Those binaries are not declared in the skill metadata — this is a minor transparency gap but not necessarily dangerous. - Ensure you trust the 'uxc' CLI/tool referenced here; it is central to how this skill issues requests and manages credentials. If you don't control uxc, inspect its configuration and behavior before binding credentials. If the owner can update the registry metadata to list NOTION_API_TOKEN (or declare the primary credential) and any required helper binaries, and more clearly warn about header leakage when reusing credentials, that would resolve the main concerns.

Type: OpenClaw Skill Name: notion-openapi-skill Version: 1.0.0 The notion-openapi-skill bundle is a legitimate tool for interacting with the Notion Public API via the uxc utility. It provides a curated OpenAPI schema (notion-public.openapi.json), clear authentication setup instructions, and safety guardrails in SKILL.md that require explicit user confirmation for write operations. The validation script (validate.sh) ensures adherence to security and versioning standards, and no evidence of data exfiltration, malicious execution, or prompt injection was found.