Diy Pc Ingest

Ingest pasted PC parts purchase/config text (Discord message receipts, bullet lists) into Notion DIY_PC tables (PCConfig, ストレージ, エンクロージャー, PCInput). Use when the user pastes raw purchase logs/spec notes and wants the AI to classify, enrich via web search, ask follow-up questions for unknowns, and then upsert rows into the correct Notion data sources using the 2025-09-03 data_sources API.

This skill appears to do what it claims: parse pasted PC part text and upsert rows into Notion. Before installing or running it: - Provide a dedicated Notion integration token (NOTION_API_KEY) with only the necessary DB/page access; do not reuse high-privilege tokens. - Be aware the skill will write ~/.config/diy-pc-ingest/config.json when bootstrapping IDs and may read ~/.config/notion/api_key or other env-vars (DIY_PC_INGEST_CONFIG, NOTION_API_KEY_FILE). Inspect that config and remove any secrets before sharing. - Review scripts/notion_apply_records.js and bootstrap_config.js (they are readable JS) to confirm behavior and to see what fields will be sent to Notion. - If you want to limit network exposure, run the skill in a controlled environment or temporarily restrict the integration's access while testing. - Because registry metadata omitted required env/config declarations, treat the omission as an informational mismatch (not necessarily malicious) and confirm you can supply the required NOTION_API_KEY and local config before enabling the skill.

Type: OpenClaw Skill Name: openclaw-skill-diy-pc-ingest Version: 2.0.1 The skill is designed to ingest PC parts data into Notion databases, which is a legitimate purpose. However, the `SKILL.md` explicitly instructs the AI agent to use `web_search/web_fetch` for data enrichment. While the stated intent is benign, this capability allows the agent to make arbitrary external network requests, which presents a significant vulnerability for prompt injection or data exfiltration if the agent is compromised or given a malicious prompt. The underlying Python and Node.js scripts (`scripts/notion_apply_records.py`, `scripts/notion_apply_records.js`) are otherwise clean, interacting only with the legitimate Notion API and local configuration files, and do not show signs of intentional malice or unauthorized actions beyond their stated purpose.