Agent skill · security · jeremylongshore
notion-security-basics
Establish a security baseline for Notion credentials, capabilities, content access, webhooks, writes, logs, and tenant isolation. Use when designing, reviewing, or hardening an integration. Trigger with "secure Notion integration", "audit Notion security", or "review Notion token handling".
Why this skill is useful
Provides specific security practices for Notion API integrations that the AI wouldn't reliably generate on its own.
What it needs
Requires node installed locally. Requires notion account access. About 2k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Notion Integration Security Baseline Overview Establish a security baseline for Notion credentials, capabilities, content access, webhooks, writes, logs, and tenant isolation.. This workflow produces an auditable decision or artifact before any live action. Prerequisites Current first-party Notion documentation and the selected integration's tested API-version contract. A named workspace owner, content or data owner, and operation owner. Synthetic or approved non-production fixtures with secrets and workspace content removed. Current Contract Security spans bearer-token custody, OAuth state and workspace binding, minimum capabilities, explicit content sharing, webhook signature verification, version-safe parsing, idempotent writes, telemetry redaction, and incident revocation. Recheck the dated evidence map before relying on mutable fields, endpoints, versions, limits, or delivery behavior. Authentication Store credentials only in the approved secret system, encrypt public-connection tokens at rest, separate environments and tenants, and test rotation and revocation. Instructions 1. Inventory connections, owners, workspaces, capabilities, shared roots, secrets, callbacks, subscriptions, and processors. 2. Minimize access and prove denied paths for unshared or unauthorized content. 3. Threat-model OAuth state, callback binding, token storage, webhook verification, replay, SSRF, logs, caches, queues, and exports. 4. Add payload validation, unknown-field tolerance, request limits, retry budgets, idempotency, and destructive-action gates. 5. Instrument content-safe security events and define credential-compromise containment. 6. Exercise rotation, revocation, tenant swap, forged webhook, over-limit payload, and rollback. Tool Discipline Use Read, Glob, and Grep to inspect documentation, configuration, code, fixtures, and evidence. Use Write and Edit only for approved repository artifacts. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/notion-security-basics