Oathe Security Badge

Is Charpup/openclaw-notion-mcp-wrapper safe?

https://github.com/Charpup/openclaw-notion-mcp-wrapper

92
SAFE

This appears to be a legitimate, well-implemented Notion API wrapper with MCP integration, health monitoring, and fallback mechanisms. The code quality is high with comprehensive tests and proper error handling.

Category Scores

Prompt Injection 95/100 · 30%
Data Exfiltration 92/100 · 25%
Code Execution 85/100 · 20%
Clone Behavior 95/100 · 10%
Canary Integrity 100/100 · 10%
Behavioral Reasoning 88/100 · 5%

Findings (5)

LOW Mixed language documentation -5 ▶

The SKILL.md contains both English and Chinese text, which could potentially be used to hide instructions from non-Chinese speakers, though content appears benign

INFO External API connectivity -8 ▶

Skill makes legitimate API calls to Notion service as expected for its functionality

MEDIUM Executable code components -15 ▶

Skill contains JavaScript code and executable scripts, which is expected for a Node.js skill but increases risk surface

LOW Network activity during installation -5 ▶

Standard git clone network activity observed, all connections appear legitimate

MEDIUM API token requirement and hardcoded operations -12 ▶

Skill requires NOTION_TOKEN access and contains hardcoded page operations that could modify user's Notion workspace