Is "MailNotes - AI Email to Notion" on Chrome Web Store Safe to Install?

AI Security Review

Risky Plugins reviewed this extension with an AI-assisted security workflow on 2026-04-28. The review verdict is likely false positive with 85% confidence.

Recommended action: no action.
Risk context: MEDIUM risk, score 53/100.
Evidence context: threat category none; evidence quality strong.

The MailNotes extension (version 1.8.1) presents a clean finding profile consistent with legitimate functionality. The extension claims to "analyze emails with AI and save them directly to your Notion databases," and the evidence supports this stated purpose.

The single manifest finding, MANIFEST-SENSITIVE-PERM-TABS in manifest.json, flags the 'tabs' permission. For an email-to-Notion integration, this permission is functionally necessary to read email content from browser tabs. While tabs is a sensitive permission, its use here aligns with the extension's documented purpose rather than indicating malicious intent.

All five network findings are generic fetch calls without any associated suspicious domains. NET-FETCH-background.js-27 and NET-FETCH-background.js-89 represent standard background script communication. NET-FETCH-sidebar.js-610 and NET-FETCH-sidebar.js-411 correspond to the sidebar UI component. NET-FETCH-analytics.js-37 explicitly indicates analytics functionality. None of these findings include specific IoCs, custom search domains, or external data exfiltration endpoints.

Critically, the findings summary shows zero malware signatures, zero obfuscation findings, zero code-smell detections, and zero IoC matches. This absence is highly significant. Malicious extensions typically trigger at least one malware signature or obfuscation rule when present. The complete lack of these indicators strongly suggests benign code.

The strongest counterargument would be the anonymous developer attribution ([email protected] email address rather than a company name) combined with the low user count of 20. Skeptics might argue this anonymity enables malicious actors to operate without accountability. However, anonymous developer attribution alone does not constitute evidence of harm. The code findings themselves—the actual behavioral evidence—show no malicious patterns. The tabs permission, while sensitive, is justified by the extension's email-reading purpose. The network activity consists of expected fetch calls without suspicious destinations. Anonymity increases risk tolerance but does not override the absence of actual malicious indicators.

The extension represents a legitimate tool with standard permissions and network behavior. No evidence supports malicious classification.

Key Reasons

• Zero malware signatures detected
• Zero obfuscation findings
• Zero suspicious IoC domains
• Network activity matches stated functionality
• Tabs permission justified by email-reading purpose

False Positive Considerations

• Generic fetch calls flagged without domain context
• Sensitive manifest permission flagged for legitimate use case
• Low user count creating false risk perception