Back to skill
Skillv1.0.0
ClawScan security
Getnote Daily Sync · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 11, 2026, 4:20 AM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's code, docs, and required credentials align with its stated purpose (pulling Get笔记 data and writing a structured daily page to Notion); nothing in the package or script appears disproportionate or unrelated to that goal.
- Guidance
- This skill appears to do what it says: fetch today's notes from Get笔记 and create a structured Notion page. Before installing: (1) Verify source/trust — the skill has no homepage and a registry owner id only; review the included Python script yourself. (2) Use least-privilege credentials: create a Notion integration limited to the target database, and avoid using tokens with unnecessary workspace-wide rights. (3) For Get笔记, use an API key that’s scoped appropriately if possible. (4) Because the registry metadata omits the declared env vars, confirm which environment variables your OpenClaw config will actually set. (5) Run initially with a test Notion database or dummy data in an isolated environment, and rotate tokens if you later remove the skill or have any concern.
Review Dimensions
- Purpose & Capability
- noteThe skill claims to sync Get笔记 (biji.com) to Notion and the included script calls openapi.biji.com and api.notion.com and uses GETNOTE_* and NOTION_* credentials — this matches the stated purpose. Note: registry-level metadata at the top indicated "Required env vars: none / Primary credential: none", while package.json and SKILL.md declare the required env vars (GETNOTE_API_KEY, GETNOTE_CLIENT_ID, NOTION_TOKEN, NOTION_DATABASE_ID). That metadata mismatch is a documentation/inventory inconsistency but not evidence of malicious behavior.
- Instruction Scope
- okSKILL.md and the script limit actions to: calling Get笔记 API, parsing notes, and calling the Notion API to create pages and blocks. Instructions do not request access to unrelated files, other services, or system credentials. Cron scheduling examples are ordinary for automation.
- Install Mechanism
- okThere is no install spec that downloads/extracts third-party code; the skill is instruction-plus-script only. The Python script uses the standard library (urllib) and writes nothing to disk beyond interacting with Notion via API calls.
- Credentials
- noteThe environment variables the skill asks for (Get笔记 API key & client id, Notion integration token & database id, optional MY_NAME) are exactly what is needed for the described integration — reasonable and proportionate. Again note the registry metadata inconsistency which lists no required env vars while package.json and SKILL.md do list them; verify env requirements before installing.
- Persistence & Privilege
- okThe skill does not request permanent/forced inclusion (always: false). It can be scheduled to run regularly (Cron), which is expected for a daily-sync skill. The script does not modify other skills or system-wide agent settings.