Notion Sync

Sync local workspace directories and files to Notion pages using the notion-sync CLI or programmatic API. Use when the user wants to push files to Notion, mi...

This skill appears to do what it says: mirror a local directory to Notion. Before using it, (1) create a Notion integration with the minimum scopes needed and use that token; (2) keep the generated .notion-sync.json out of version control (the default ignore list already includes it, but double-check your repo’s .gitignore) because it contains the token in plaintext; (3) run sync with --dry-run or --diff first to preview changes; (4) be aware that updates clear and re-append page blocks, which can overwrite existing content in the target Notion pages—test on a dedicated root page or a small sample directory first; and (5) review the token and page sharing settings in Notion so the integration only has access to the intended pages.

Type: OpenClaw Skill Name: openclaw-notion-sync Version: 0.1.0 The skill's core functionality involves reading local files and syncing them to Notion, which requires both file system and network access, consistent with its stated purpose. However, the Notion API token is stored in plain text within the `.notion-sync.json` configuration file. While this is a common practice for CLI tools, it represents a vulnerability as it exposes sensitive credentials if the config file is compromised. There is no evidence of intentional malicious behavior such as exfiltration to unauthorized endpoints, persistence mechanisms, or prompt injection attempts designed to subvert the agent's purpose beyond the stated functionality.