·
Last changedVersion:
This version passed the hardening gate. Hardening applied 1 targeted change and preserved all other text. Classified findings before hardening: 6. Classified findings closed: 5. Classified findings remaining: 1. Unclassified scanner findings remaining: 0. Review findings closed: 7. Review findings remaining: 16.
3
3
1
Expand | File | Group | Subtype | Severity | Status |
|---|---|---|---|---|---|
SKILL.md | Malicious Code & Command Execution | Dynamic code execution | High | Closed | |
SKILL.md | Supply Chain & Install-Time Trust | Dependency or plugin compromise | High | Closed | |
SKILL.md | Tool & MCP Manipulation | Unauthorized tool use | High | Closed | |
SKILL.md | Malicious Code & Command Execution | — | Medium | Closed | |
SKILL.md | Supply Chain & Install-Time Trust | Install-time download and execute | Medium | Closed | |
SKILL.md | Prompt Injection | Direct prompt injection | Medium | Open |
6 findings
The CLI is self-documenting. Always prefer running these commands over guessing syntax or relying on memorized knowledge:
ntn api ls — list every public API endpoint.ntn api <path> --help — show methods, doc links, and usage for an endpoint.ntn api <path> --docs — print the full official docs for an endpoint.ntn api <path> --spec — print a reduced OpenAPI fragment (useful for
understanding request/response schemas).ntn pages get <page-id> — retrieve a page as Markdown. Use this to read page
content.ntn <command> --help — help for any command or subcommand.NOTION_API_TOKEN when it is set.NOTION_API_TOKEN first. If it is already set, prefer using it instead
of telling the user to run ntn login.ntn login / ntn logout — log the CLI in or out (only use if not using
NOTION_API_TOKEN). ntn login requires the user to visit a URL in a web
browser.ntn apiRun ntn api --help for full syntax. Quick summary:
The method is inferred (GET by default, POST when a body is present). Override
with -X METHOD.
Prefer ntn pages create / ntn pages update for Markdown page content. Use
the markdown field when creating or updating comments via ntn api.
The markdown field supports inline formatting (bold, italic, code, links, etc.).
Only fall back to rich_text if you need features that Markdown cannot express (e.g. mentions, custom emoji, or colors).
ntn filesConvenience wrapper around the File Uploads API.
ntn workersManage Notion workers (deploy, list, execute, etc.). Run ntn workers --help
for subcommands.
Get started with chainctlchainctl skill install public/makenotion/notion-cli:latest
Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.
skills.cgr.dev/public/github.com/makenotion/skills/notion-cli:latest
MIT
HARDENING.md
LICENSE
SKILL.md