Vibe Notion

Interact with Notion using the unofficial private API - pages, databases, blocks, search, users, comments

This skill uses Notion's unofficial private API and the CLI auto-extracts your token_v2 from the Notion desktop app (it will read cookies/keychain and write credentials to ~/.config/vibe-notion/credentials.json). The package source/homepage is not provided in the metadata — verify the npm package (review its repository, author, and install scripts) before installing. Consider these steps before proceeding: - Prefer the official API (use vibe-notionbot) if you want lower-risk, auditable access. - Inspect the npm package source code and install scripts locally (or run in an isolated VM/container) to confirm what it reads/writes. - Be cautious about persistent memory: the agent is instructed to read/write ~/.config/vibe-notion/MEMORY.md containing workspace IDs, page titles, and other metadata — decide whether you accept persistent storage of this data. - If you proceed, limit exposure: run the CLI in a dedicated account/container, back up/inspect the credentials file, and avoid granting broader system access. If unsure, decline or seek a version with documented provenance and an official API integration.

Type: OpenClaw Skill Name: vibe-notion Version: 1.5.0 The skill bundle facilitates Notion interaction via an unofficial private API, which involves high-risk automated extraction of 'token_v2' credentials from the Notion desktop app's local storage and system Keychain (on macOS). While this behavior is aligned with the stated purpose of the 'vibe-notion' CLI, the practice of programmatically accessing sensitive third-party application data and storing it in '~/.config/vibe-notion/credentials.json' presents a significant security risk. Additionally, 'SKILL.md' instructs the agent to maintain a persistent 'MEMORY.md' file for workspace metadata, which increases the local attack surface for sensitive information disclosure.