notion-log — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited notion-log (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This skill resolves placeholders against ~/.claude/state/personal_config.json. See _config/README.md and _config/personal_config.example.json for setup. If the config is missing or a needed field is unset, the skill must surface an error to the user and refuse to proceed rather than guess.
Project page IDs come from personal_config.notion.project_pages[<project>]. Off-limits pages (Weekly Agenda, Tasks DB, personal pages) come from personal_config.notion.off_limits_pages and personal_config.notion.tasks_db_id / personal_config.notion.weekly_agenda_page_id. Filesystem locations for project subdirs come from personal_config.paths.overleaf_root and personal_config.projects[].overleaf_subdir.
Append-only diary for the user's active research projects in Notion. The user finishes a coding or writing session and wants a single timestamped paragraph at the bottom of the relevant project page recording what got done, with bullets for sub-items and a follow-ups: tail listing open todos surfaced in the summary.
This is a diary skill, not a task skill. It writes prose to a project page. It does not file todos (that's /log-todo), it does not process Telegram replies (that's /capture), it does not edit historical bullets in place (loses history — never do this).
Invoke whenever the user signals end-of-session reporting on a research project. Triggers include:
/notion-log ProjectA: finished tertile robustness, started Section 4If the user just describes work but doesn't say "log it," ask once whether they want it logged before doing anything — don't auto-log unsolicited.
Map the project tag in the invocation to a Notion page ID, resolved from personal_config.notion.project_pages. The tag is whatever appears before the first colon (case-insensitive, common abbreviations resolved). Each project entry in personal_config.projects[] may declare aliases to absorb common shorthand.
Illustrative shape (the live mapping is driven by the user's config):
| Project tag (accepted variants) | Notion page ID |
|---|---|
| ProjectA, ProjectA aliases | personal_config.notion.project_pages["ProjectA"] |
| ProjectB, ProjectB aliases | personal_config.notion.project_pages["ProjectB"] |
| ProjectC, ProjectC aliases | personal_config.notion.project_pages["ProjectC"] |
If the tag is ambiguous or unrecognized, ask the user once which project they mean, then proceed. Never guess silently — wrong-page writes are hard to undo because the skill doesn't read history before appending.
For context references inside log entries (file paths, repos), the canonical filesystem locations come from personal_config.paths.overleaf_root joined with personal_config.projects[*].overleaf_subdir, e.g. <OVERLEAF_ROOT>/<PROJECT_SUBDIR>/.
personal_config). If no colon (e.g., "log my work on ProjectB"), pattern-match a project name out of the surrounding text. If still ambiguous, ask the user once.Project: prefix, after resolving the project name use the whole remaining text.follow-ups: tail. If none, omit the tail. <YYYY-MM-DD> <morning|afternoon|evening|late-night> — <one-sentence summary>
• <bullet 1>
• <bullet 2>
follow-ups: <comma-list>Time-of-day is rough (morning before 12, afternoon 12–17, evening 17–22, late-night 22–04). Bullets are optional — only include if the work splits cleanly into multiple sub-items. A one-thing session is fine as a single line with no bullets.
Format dates as bold (**2026-05-11**). Format file paths and commit hashes as inline code. Format URLs as links.
mcp__notion__notion-update-page (or whichever Notion MCP tool appends children — check available tools at invocation time; the correct tool is the one that adds block children to an existing page without modifying existing blocks). Append a single paragraph block (or a small group: paragraph + bulleted_list_items + paragraph for follow-ups) to the END of the target project page. Do NOT modify existing blocks. Do NOT delete blocks. Do NOT touch the page's title or properties.If the Notion MCP exposes a mention-date block primitive (e.g., <mention-date start="..." timeZone="America/New_York"/>), prefer that over a plain text date. If not, plain bold text date is fine.
#123) → leave as plain text unless the repo is unambiguous. Logged to <Project Name> page. <N> follow-up(s) detected.If N > 0, append a one-liner suggesting /log-todo to file them as actual tasks. If N == 0, omit that line.
These pages are explicitly off-limits for this skill, even if the user asks (confirm and refuse, or redirect to a different skill):
personal_config.notion.weekly_agenda_page_id) — that's the active todo surface; appending diary prose pollutes it. If the user wants a weekly recap, suggest a separate weekly-recap page or just write it as part of the relevant project page.personal_config.notion.tasks_db_id) — that's /log-todo's territory. Diary entries are not tasks./daily-brief, ephemeral.personal_config.notion.off_limits_pages (e.g., grocery lists, cook lists, jokes, bucket lists, onboarding details, ongoing-thoughts pages that contain personal finance info).If the resolved page ID is not in the active-project map, stop and confirm before writing.
Example 1 — ProjectA progress log (with follow-ups).
Invocation:
/notion-log ProjectA: finished reproducing tertile robustness in Section 5.2, started writing the R2 response to Reviewer 2's identification concern. Still need to redo the placebo with the new bandwidth and email a coauthor about the panel data extension.Resolved project: ProjectA → personal_config.notion.project_pages["ProjectA"].
Appended entry (rendered as Notion blocks):
**2026-05-11** afternoon — Finished tertile robustness in 5.2 and began R2 reply to R2's identification concern.
• Reproduced tertile robustness, Section 5.2 of `<OVERLEAF_ROOT>/<PROJECT_SUBDIR>/`
• Drafted opening of R2-Reviewer2 identification response
follow-ups: redo placebo with new bandwidth, email coauthor re panel data extensionReport: Logged to ProjectA page. 2 follow-ups detected — run /log-todo to file them as tasks.
Example 2 — ProjectB idea note (no follow-ups, single bullet).
Invocation:
diary: ProjectB — read Berger & Packard (2022) on linguistic similarity, thinking it could ground the cover-text similarity measure used in Section 3Resolved project: ProjectB → personal_config.notion.project_pages["ProjectB"].
Appended entry:
**2026-05-11** evening — Reading note: Berger & Packard (2022) on linguistic similarity could ground the similarity measure in Section 3.Report: Logged to ProjectB page.
Example 3 — Post-meeting summary.
Invocation:
session log: ProjectC — met with coauthor, agreed to switch from 16k to 32k SAE features. Need to retrain overnight and update the demo defaults to match new feature IDs.Resolved project: ProjectC → personal_config.notion.project_pages["ProjectC"].
Appended entry:
**2026-05-11** afternoon — Coauthor meeting: agreed to switch from 16k → 32k SAE features.
• Retrain overnight
• Update demo defaults to match new feature IDs
follow-ups: retrain SAE 32k, update demo defaultsReport: Logged to ProjectC page. 2 follow-ups detected — run /log-todo to file them as tasks.
personal_config, ask the user which one. Do not pick a default.~/.claude/skills/notion-log/unsent/<date>.md) so the work isn't lost. Do not silently swallow the error./log-todo's job. This skill mentions follow-ups in prose and suggests /log-todo; it does not create task rows itself.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.