notion
Pass
Audited by Gen Agent Trust Hub on Aug 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The
README.mdinstructions suggest downloading and installing the Bun runtime fromhttps://bun.sh/install. This reference targets a well-known technology service. - [REMOTE_CODE_EXECUTION]: The setup guide includes a pattern to pipe a remote script to bash (
curl -fsSL https://bun.sh/install | bash). While this is a remote execution pattern, it is a standard installation method for the Bun developer tool. - [COMMAND_EXECUTION]: The skill's primary functionality relies on executing a TypeScript script using the
bunruntime, which is the intended execution environment. - [DATA_EXPOSURE]: The skill accesses a
NOTION_API_KEYstored in a local.envfile. The documentation and code include safeguards to prevent accidental exposure of these credentials in logs or chat outputs. - [SAFE]: The implementation in
scripts/notion.tscommunicates exclusively with the official Notion API domain (api.notion.com) for reading and writing workspace data.
Audit Metadata