安全扫描
OpenClaw
可疑
medium confidence该技能似乎是一个简单的Notion API操作指南,但其运行时指令访问和创建本地秘密文件,而技能元数据未声明任何所需的凭证——加上小的所有者ID不匹配——因此包内部不一致,需要谨慎。
评估建议
此技能基本上是基于curl的Notion API配方,意图上可能是安全的,但在安装之前有一些不一致您应该考虑:1) 元数据未声明所需的凭证,而SKILL.md告诉您创建~/.config/notion/api_key,代理将读取它——确认您对在该文件中存储Notion密钥感到满意,并考虑使用平台密钥存储或环境变量代替;2) 指令写入纯文本密钥文件,而不建议安全文件权限(使用chmod 600或密钥管理器);3) _meta.json中的包元数据ownerId与注册表所有者ID不匹配——验证发布者/来源(主页是Notion的文档,但来源未知);4) 因为这是纯指令的,没有代码,如果调用,代理将只执行SKILL.md中的命令,但缺少的凭证声明降低了透明度。如果您继续,请验证Notion中的集成范围,并将API密钥限制为您与其共享的页面/数据库。...详细分析 ▾
ℹ 用途与能力
技能的名称/描述(Notion API客户端)与提供的curl示例和操作匹配。然而,元数据未声明所需的凭证,而指令明确要求存储在~/.config/notion/api_key的Notion API密钥。这种不匹配可能是疏忽,但不一致。
⚠ 指令范围
SKILL.md指导代理/用户在~/.config/notion中创建文件并读取该文件(NOTION_KEY=$(cat ~/.config/notion/api_key))。因此,指令访问元数据中未声明的本地文件系统状态,还指导写入纯文本秘密文件,而不提供安全文件权限的指导。除了秘密文件和对api.notion.com的API调用之外,指令保持在预期的Notion使用范围内。
✓ 安装机制
无安装规范,无捆绑代码——纯指令技能——因此除了代理遵循文字之外,平台安装程序不会向磁盘写入任何内容。从安装角度来看,这是最低风险的。
⚠ 凭证需求
该技能合法需要Notion API令牌,但清单未列出所需的环境变量或主凭证。SKILL.md告诉用户在~/.config/notion/api_key以纯文本存储秘密令牌,然后读取它——这对于Notion助手是预期的,但应在requires.env/所需配置路径中声明。以纯文本存储令牌也是安全考虑;密钥管理器或平台的密钥存储会更可取。
✓ 持久化与权限
该技能不请求always:true,没有安装脚本;它只会在调用时使用令牌。请记住,如果允许代理自主调用技能(默认),任何提供的令牌都可能被代理使用而无需额外确认——这是标准行为,但如果令牌被授予不受信任的技能,会增加影响范围。
安装前注意事项
- the metadata declares no required credentials while the SKILL.md tells you to create ~/.config/notion/api_key and the agent will read it — confirm you are comfortable storing a Notion key in that file and consider using a platform secret store or environment variable instead; (
- the instructions write a plaintext key file without advising secure file permissions (use chmod 600 or a secrets manager); (
- the package metadata ownerId in _meta.json does not match the registry owner ID — verify the publisher/source (homepage is Notion's docs but source is unknown); (
- because this is instruction-only with no code, the agent will execute only the commands in SKILL.md if invoked, but the missing credential declaration reduces transparency. If you proceed, verify the integration's scopes in Notion and restrict the API key to only the pages/databases you share with it.
安全有层次,运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/2/25
● 无害
安装命令 点击复制
官方npx clawhub@latest install notion-1-0-0
镜像加速npx clawhub@latest install notion-1-0-0 --registry https://cn.clawhub-mirror.com
技能文档
Use the Notion API to create/read/update pages, data sources (databases), and blocks.
Setup
- 创建 integration 在 https://notion.所以/my-integrations
- 复制 API 键 (starts 带有
ntn_或secret_) - Store :
mkdir -p ~/.config/notion
echo "ntn_your_key_here" > ~/.config/notion/api_key
- 分享 target pages/databases 带有 integration (click "..." → "Connect 到" → integration name)
API Basics
All requests need:
NOTION_KEY=$(cat ~/.config/notion/api_key)
curl -X GET "https://api.notion.com/v1/..." \
-H "Authorization: Bearer $NOTION_KEY" \
-H "Notion-Version: 2025-09-03" \
-H "Content-Type: application/json"
Note: TheNotion-Versionheader is required. This skill uses2025-09-03(latest). In this version, databases are called "data sources" in the API.
Common Operations
搜索 对于 pages 和 data sources:
curl -X POST "https://api.notion.com/v1/search" \
-H "Authorization: Bearer $NOTION_KEY" \
-H "Notion-Version: 2025-09-03" \
-H "Content-Type: application/json" \
-d '{"query": "page title"}'
获取 page:
curl "https://api.notion.com/v1/pages/{page_id}" \
-H "Authorization: Bearer $NOTION_KEY" \
-H "Notion-Version: 2025-09-03"
获取 page content (blocks):
curl "https://api.notion.com/v1/blocks/{page_id}/children" \
-H "Authorization: Bearer $NOTION_KEY" \
-H "Notion-Version: 2025-09-03"
创建 page 在...中 data source:
curl -X POST "https://api.notion.com/v1/pages" \
-H "Authorization: Bearer $NOTION_KEY" \
-H "Notion-Version: 2025-09-03" \
-H "Content-Type: application/json" \
-d '{
"parent": {"database_id": "xxx"},
"properties": {
"Name": {"title": [{"text": {"content": "New Item"}}]},
"Status": {"select": {"name": "Todo"}}
}
}'
查询 data source (数据库):
curl -X POST "https://api.notion.com/v1/data_sources/{data_source_id}/query" \
-H "Authorization: Bearer $NOTION_KEY" \
-H "Notion-Version: 2025-09-03" \
-H "Content-Type: application/json" \
-d '{
"filter": {"property": "Status", "select": {"equals": "Active"}},
"sorts": [{"property": "Date", "direction": "descending"}]
}'
创建 data source (数据库):
curl -X POST "https://api.notion.com/v1/data_sources" \
-H "Authorization: Bearer $NOTION_KEY" \
-H "Notion-Version: 2025-09-03" \
-H "Content-Type: application/json" \
-d '{
"parent": {"page_id": "xxx"},
"title": [{"text": {"content": "My Database"}}],
"properties": {
"Name": {"title": {}},
"Status": {"select": {"options": [{"name": "Todo"}, {"name": "Done"}]}},
"Date": {"date": {}}
}
}'
更新 page properties:
curl -X PATCH "https://api.notion.com/v1/pages/{page_id}" \
-H "Authorization: Bearer $NOTION_KEY" \
-H "Notion-Version: 2025-09-03" \
-H "Content-Type: application/json" \
-d '{"properties": {"Status": {"select": {"name": "Done"}}}}'
添加 blocks 到 page:
curl -X PATCH "https://api.notion.com/v1/blocks/{page_id}/children" \
-H "Authorization: Bearer $NOTION_KEY" \
-H "Notion-Version: 2025-09-03" \
-H "Content-Type: application/json" \
-d '{
"children": [
{"object": "block", "type": "paragraph", "paragraph": {"rich_text": [{"text": {"content": "Hello"}}]}}
]
}'
属性 Types
Common property formats for database items:
- Title:
{"title": [{"text": {"content": "..."}}]} - Rich text:
{"rich_text": [{"text": {"content": "..."}}]} - Select:
{"select": {"name": "选项"}} - Multi-select:
{"multi_select": [{"name": ""}, {"name": "B"}]} - 日期:
{"日期": {"开始": "2024-01-15", "end": "2024-01-16"}} - Checkbox:
{"checkbox": 真} - 数字:
{"数字": 42} - URL:
{"url": "https://..."} - Email:
{"email": "@b.com"} - Relation:
{"relation": [{"id": "page_id"}]}
键 Differences 在...中 2025-09-03
- Databases → Data Sources: 使用
/data_sources/endpoints 对于 queries 和 retrieval - Two IDs: 每个 数据库 现在 有 both
database_id和data_source_id
database_id 当...时 creating pages (parent: {"database_id": "..."})
- 使用 data_source_id 当...时 querying (POST /v1/data_sources/{id}/查询)
- 搜索 results: Databases return 作为
"对象": "data_source"带有data_source_id - Parent 在...中 responses: Pages show
parent.data_source_idalongsideparent.database_id - Finding data_source_id: 搜索 对于 数据库, 或 call
获取 /v1/data_sources/{data_source_id}
Notes
- Page/数据库 IDs UUIDs (带有 或 没有 dashes)
- API cannot 设置 数据库 视图 filters — 's UI-仅
- Rate limit: ~3 requests/第二个 平均值
- 使用
is_inline: 真当...时 creating data sources 到 embed them 在...中 pages
数据来源:ClawHub ↗ · 中文优化:龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险,如需更匹配、更安全的方案,建议联系付费定制