Agent Economy ReportAgent Economy ReportCAUTION version 1.0.0 · audited 2026-09-09
This is a documentation-only skill: a Markdown reference showing how to call the Notion API with curl. It tells the user to store a Notion integration token in a plain file at ~/.config/notion/api_key, then read that token and send it as a Bearer header to api.notion.com. All example requests go to Notion's own official endpoints; there are no third-party servers, no downloads, no scripts, and no obfuscated or encoded content. The only real risks are inherent to the task: the token is stored unencrypted (no permission hardening shown) and several examples create, update, or add content in a live Notion workspace. No payment, wallet, persistence, or credential-exfiltration behavior is present.
| Declared purpose | "Notion API for creating and managing pages, databases, and blocks" — guidance for creating, reading, updating and querying Notion pages, data sources and blocks. |
| Observed behavior | Provides bash/curl snippets that (1) create ~/.config/notion and write the API key into a file, (2) read that key into a NOTION_KEY variable, and (3) issue GET/POST/PATCH requests to https://api.notion.com/v1/... with the key as an Authorization header. Nothing else executes; there is no installer, no runtime code, and no network destination other than Notion's API. |
| Verdict, rules only | CAUTION · reads credential-like environment variables: NOTION_KEY |
| Verdict, AI | SAFE |
| Final verdict | CAUTION (never better than either pass) |
| capability | vs purpose | detail |
|---|---|---|
| network | needed | curl requests to https://api.notion.com/v1/ endpoints only (SKILL.md lines 28, 40, 49, 56, 63, 78, 90, 107, 116). |
| shell | needed | bash snippets using mkdir, echo, cat and curl (SKILL.md lines 17-20, 26-32). |
| filesystem_write | needed | Writes the API key to ~/.config/notion/api_key (SKILL.md line 19). |
| filesystem_read | needed | Reads the stored key back via cat (SKILL.md line 27). |
| credentials | needed | Handles a Notion integration token (NOTION_KEY) stored in plaintext and sent only to api.notion.com (SKILL.md lines 15, 27, 29). |
| severity | finding |
|---|---|
| low | API token stored in plaintext without permission hardening The setup writes the Notion integration token to a plain file. No chmod 600 or umask is applied, so on a shared or multi-user machine the token could be readable by other accounts. The skill-card claims 'restrictive permissions' as a mitigation but the commands do not set them. SKILL.md:19 echo "ntn_your_key_here" > ~/.config/notion/api_key |
| info | Credential sent only to Notion's official API The token is used as a Bearer header against https://api.notion.com; no alternative or hidden host receives the credential anywhere in the package. SKILL.md:29 -H "Authorization: Bearer $NOTION_KEY" \ |
| low | Write/modify operations against a live workspace Several examples (POST /pages, POST /data_sources, PATCH /pages, PATCH /blocks) create or mutate real Notion content. An agent following this guidance can change workspace data; scope the integration to only the pages it needs. SKILL.md:116 curl -X PATCH "https://api.notion.com/v1/blocks/{page_id}/children" \ |
| info | Broad read of shared workspace content The search endpoint returns everything the integration has been granted access to, so workspace data can be pulled into the agent's context. This is expected for the declared purpose but limits data minimization. SKILL.md:40 curl -X POST "https://api.notion.com/v1/search" \ |
0 AI finding(s) were dropped because their file, line or quote did not match the package.
| domain | service rating | where |
|---|---|---|
| api.notion.com | not in the service index | SKILL.md:28 |
| clawhub.ai | not in the service index | skill-card.md:7 |
| developers.notion.com | not in the service index | SKILL.md:4 |
| notion.so | not in the service index | SKILL.md:14 |
| Binaries invoked | bash, curl |
| Environment variables read | NOTION_KEY |
| Hard-coded wallets | none |
| Pipes a download to a shell | 0 |
| eval / exec / subprocess | 0 |
| base64 blobs | 0 |
| File writes | 1 |
| Persistence | 0 |
| file | lines | sha256 |
|---|---|---|
SKILL.md | 156 | 1002bcb8230ff496… |
_meta.json | 6 | 24a9dbcc358b20c2… |
skill-card.md | 40 | a28447c7d0d53430… |
For agents
JSON: https://agenteconomy.report/k/notion.audit.json · badge: https://agenteconomy.report/k/notion.audited.svg ·
skill rating: /k/notion · commission an audit of any skill: US$ 29 per version.
The complete published package of this exact version was downloaded from the registry and read statically; nothing was executed. A deterministic pass extracts network destinations, binaries, environment variables, writes, install commands, obfuscation markers, subprocesses and wallets, each with file and line. An AI then reads the whole package with those facts and writes the summary, the capabilities and the findings under a strict schema; every finding it produces must cite a file, a line and the exact text, or it is dropped. The final verdict is the worst of the two passes. The audit does not change the skill's trust tier (policy); the author may respond through the dispute channel and the response is published here. Commissioned by: the Agent Economy Report (free program: the 150 most downloaded skills, September 2026).