notion

Integrates with Notion API and CLI for managing pages, databases, and markdown content efficiently.

Install this skill

or

0/100

Security score

The notion skill was audited on May 17, 2026 and we found 51 security issues across 5 threat categories, including 3 high-severity. Review the findings below before installing.

Categories Tested

Security Issues

medium line 360

Template literal with variable interpolation in command context

SourceSKILL.md

360	execute: async ({ name }) => `Hello, ${name}!`,

high line 39

Piping content to bash shell

SourceSKILL.md

39	curl -fsSL https://ntn.dev \| bash

medium line 39

Curl to non-GitHub URL

SourceSKILL.md

39	curl -fsSL https://ntn.dev \| bash

medium line 158

Curl to non-GitHub URL

SourceSKILL.md

158	curl -s -X GET "https://api.notion.com/v1/..." \

medium line 168

Curl to non-GitHub URL

SourceSKILL.md

168	curl -s -X POST "https://api.notion.com/v1/search" \

medium line 177

Curl to non-GitHub URL

SourceSKILL.md

177	curl -s "https://api.notion.com/v1/pages/{page_id}" \

medium line 187

Curl to non-GitHub URL

SourceSKILL.md

187	curl -s "https://api.notion.com/v1/pages/{page_id}/markdown" \

medium line 194

Curl to non-GitHub URL

SourceSKILL.md

194	curl -s "https://api.notion.com/v1/blocks/{page_id}/children" \

medium line 204

Curl to non-GitHub URL

SourceSKILL.md

204	curl -s -X POST "https://api.notion.com/v1/pages" \

medium line 217

Curl to non-GitHub URL

SourceSKILL.md

217	curl -s -X PATCH "https://api.notion.com/v1/pages/{page_id}/markdown" \

medium line 226

Curl to non-GitHub URL

SourceSKILL.md

226	curl -s -X POST "https://api.notion.com/v1/pages" \

medium line 241

Curl to non-GitHub URL

SourceSKILL.md

241	curl -s -X POST "https://api.notion.com/v1/data_sources/{data_source_id}/query" \

medium line 253

Curl to non-GitHub URL

SourceSKILL.md

253	curl -s -X POST "https://api.notion.com/v1/data_sources" \

medium line 270

Curl to non-GitHub URL

SourceSKILL.md

270	curl -s -X PATCH "https://api.notion.com/v1/pages/{page_id}" \

medium line 279

Curl to non-GitHub URL

SourceSKILL.md

279	curl -s -X PATCH "https://api.notion.com/v1/blocks/{page_id}/children" \

medium line 293

Curl to non-GitHub URL

SourceSKILL.md

293	curl -s -X POST "https://api.notion.com/v1/file_uploads" \

medium line 333

Webhook reference - potential data exfiltration

SourceSKILL.md

333	- Webhooks — receive HTTP events from external services (GitHub, Stripe, etc.) and act in Notion.

medium line 364

Webhook reference - potential data exfiltration

SourceSKILL.md

364	### Webhook capability

low line 367

Webhook reference - potential data exfiltration

SourceSKILL.md

367	worker.webhook("onGithubPush", {

medium line 378

Webhook reference - potential data exfiltration

SourceSKILL.md

378	After deploy: `ntn workers webhooks list` shows the URL Notion generates. Treat that URL as a secret — anyone with it can POST events unless you add signature verification.

low line 388

Webhook reference - potential data exfiltration

SourceSKILL.md

388	ntn workers env set GITHUB_WEBHOOK_SECRET=...

low line 391

Webhook reference - potential data exfiltration

SourceSKILL.md

391	ntn workers webhooks list

medium line 438

Webhook reference - potential data exfiltration

SourceSKILL.md

438	\| Build a sync / webhook / agent tool hosted by Notion \| `ntn workers ...` \| WSL2 + `ntn workers ...` \|

medium line 29

Access to hidden dotfiles in home directory

SourceSKILL.md

29	3. Store in `~/.hermes/.env`:

medium line 53

Access to hidden dotfiles in home directory

SourceSKILL.md

53	Add those exports to your shell profile (or to `~/.hermes/.env`) so every session inherits them.

medium line 150

Access to hidden dotfiles in home directory

SourceSKILL.md

150	\| `NOTION_KEYRING=0` \| File-based creds at `~/.config/notion/auth.json` instead of OS keychain \|

medium line 29

Access to .env file

SourceSKILL.md

29	3. Store in `~/.hermes/.env`:

medium line 53

Access to .env file

SourceSKILL.md

53	Add those exports to your shell profile (or to `~/.hermes/.env`) so every session inherits them.

medium line 50

Access to system keychain/keyring

SourceSKILL.md

50	export NOTION_KEYRING=0 # don't try to use the OS keychain

high line 149

Access to system keychain/keyring

SourceSKILL.md

149	\| `NOTION_API_TOKEN` \| Auth token (overrides keychain) — set this to your integration token \|

high line 150

Access to system keychain/keyring

SourceSKILL.md

150	\| `NOTION_KEYRING=0` \| File-based creds at `~/.config/notion/auth.json` instead of OS keychain \|

low line 13

External URL reference

SourceSKILL.md

13	homepage: https://developers.notion.com

low line 27

External URL reference

SourceSKILL.md

27	1. Create an integration at https://notion.so/my-integrations

low line 39

External URL reference

SourceSKILL.md

39	curl -fsSL https://ntn.dev \| bash

low line 140

External URL reference

SourceSKILL.md

140	ntn files create --external-url https://example.com/photo.png

low line 158

External URL reference

SourceSKILL.md

158	curl -s -X GET "https://api.notion.com/v1/..." \

low line 168

External URL reference

SourceSKILL.md

168	curl -s -X POST "https://api.notion.com/v1/search" \

low line 177

External URL reference

SourceSKILL.md

177	curl -s "https://api.notion.com/v1/pages/{page_id}" \

low line 187

External URL reference

SourceSKILL.md

187	curl -s "https://api.notion.com/v1/pages/{page_id}/markdown" \

low line 194

External URL reference

SourceSKILL.md

194	curl -s "https://api.notion.com/v1/blocks/{page_id}/children" \

low line 204

External URL reference

SourceSKILL.md

204	curl -s -X POST "https://api.notion.com/v1/pages" \

low line 217

External URL reference

SourceSKILL.md

217	curl -s -X PATCH "https://api.notion.com/v1/pages/{page_id}/markdown" \

low line 226

External URL reference

SourceSKILL.md

226	curl -s -X POST "https://api.notion.com/v1/pages" \

low line 241

External URL reference

SourceSKILL.md

241	curl -s -X POST "https://api.notion.com/v1/data_sources/{data_source_id}/query" \

low line 253

External URL reference

SourceSKILL.md

253	curl -s -X POST "https://api.notion.com/v1/data_sources" \

low line 270

External URL reference

SourceSKILL.md

270	curl -s -X PATCH "https://api.notion.com/v1/pages/{page_id}" \

low line 279

External URL reference

SourceSKILL.md

279	curl -s -X PATCH "https://api.notion.com/v1/blocks/{page_id}/children" \

low line 293

External URL reference

SourceSKILL.md

293	curl -s -X POST "https://api.notion.com/v1/file_uploads" \

low line 316

External URL reference

SourceSKILL.md

316	- URL: `{"url": "https://..."}`

low line 394

External URL reference

SourceSKILL.md

394	When asked to build a Worker, scaffold with `ntn workers new`, write the code in `src/index.ts`, set any secrets with `ntn workers env set`, and deploy. Notion's docs at https://developers.notion.com/

low line 424

External URL reference

SourceSKILL.md

424	- Citations: `[^https://example.com]`

Scanned on May 17, 2026

View Security Dashboard

Installation guide →

GitHub Stars 153.5K

Rate this skill

Categorymarketing

UpdatedMay 20, 2026

openclaw api notion content-marketer product-manager marketing-analyst ux-designer project-manager notion marketing product design project management

NousResearch/hermes-agent