notion-md-sync
Pass
Audited by Gen Agent Trust Hub on Aug 20, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: Executes a local Python script to perform sync operations, which is the primary purpose of the skill.
- [CREDENTIALS_UNSAFE]: Accesses Notion integration tokens from environment variables rather than hardcoded strings, following recommended security practices for secret management.
- [EXTERNAL_DOWNLOADS]: Communicates with official Notion API endpoints at api.notion.com. The script includes specific hostname validation to ensure network requests only target official Notion domains.
- [DATA_EXFILTRATION]: Reads local Markdown and image files for synchronization to a remote service. The script implements strict path resolution that enforces root containment, preventing unauthorized file access through path traversal.
Audit Metadata