notion-enhanced-markdown-integration

Notion API for creating and managing pages, databases, blocks and enhanced markdown.

This skill appears to do what it says (curl calls to api.notion.com to read/write pages and markdown), but the SKILL.md and registry metadata disagree about how the Notion key is provided: the registry lists NOTION_API_KEY, while the instructions tell you to store the key in ~/.config/notion/api_key and use NOTION_KEY. Before installing, ask the author to clarify/fix: (1) which environment variable name the platform should provide (NOTION_API_KEY vs NOTION_KEY), (2) whether the skill will read ~/.config/notion/api_key — if so, that path should be declared and you should be aware of file permissions (avoid world-readable files), and (3) confirm the skill only contacts api.notion.com. If you proceed, grant the integration the minimum Notion scopes needed (read-only vs insert_content) and avoid storing long-lived keys in unsecured files. If you want higher assurance, request the full (non-truncated) SKILL.md and an explanation of secret-handling behavior so the inconsistencies can be resolved.

Type: OpenClaw Skill Name: notion-enhanced-markdown Version: 1.0.0 The skill bundle describes a non-existent 'Markdown API' and a future-dated Notion API version (2026-03-11), which will cause the agent to fail when attempting to interact with the real Notion service. Additionally, the documentation in SKILL.md provides curl examples that are vulnerable to shell command injection if the agent populates placeholders (e.g., {page_id} or {data_source_id}) with unsanitized user input. While the behavior is highly unusual and non-functional, there is no clear evidence of intentional data exfiltration or malicious backdoors.