Notion

No changelog provided.

OpenClaw analysis

The skill's instructions match a Notion API helper, but metadata omits the sensitive config path/credential it expects and the skill source is unknown — this mismatch and plaintext key guidance are concerning.

Confidence: medium

VirusTotal

Type: OpenClaw Skill Name: notion Version: 1.0.0 The skill is designed to interact with the Notion API. It instructs the user to store their Notion API key locally in `~/.config/notion/api_key` and then uses `cat` to read this key for authentication with `curl` commands. All network requests are directed to the legitimate Notion API endpoint (`https://api.notion.com`). There is no evidence of data exfiltration to unauthorized endpoints, malicious execution, persistence mechanisms, or prompt injection attempts aimed at subverting the agent for harmful purposes. The file access and network calls are directly aligned with the stated purpose of providing Notion API functionality.