ClawHub
Back to skill

Security audit

快速笔记

Security checks for vulnerabilities and agentic risk

Overview

This is a simple local note-taking skill; its main risks are ordinary plaintext local storage and possible accidental invocation, not malicious behavior.

Install only if you are comfortable with notes being saved as an unencrypted local JSON file. Avoid storing secrets or highly sensitive information, use deliberate prompts before saving, and review/delete saved notes when needed.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Note
Location
SKILL.md:28
Finding

Potentially Sensitive Notes Stored in Plaintext with Inherited File Permissions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 28 and 41–43
Vulnerability Type: Plaintext storage of potentially sensitive data with insufficiently controlled permissions
Risk Level: Low

Vulnerable Code

python
NOTES_FILE = os.path.join(os.path.dirname(__file__), "quick_notes.json")
python
def _save(self):
    with open(NOTES_FILE, "w", encoding="utf-8") as f:
        json.dump(self.notes, f, ensure_ascii=False, indent=2)

Technical Analysis

The implementation stores all note content in an unencrypted JSON file located beside the skill code. Notes may contain personal information, tasks, private ideas, or other sensitive material.

The file is created through Python's standard open() function without explicitly restricting its permissions. Its effective permissions therefore depend on the process environment and operating-system umask. In an environment with an overly permissive umask or a shared project directory, other local users or processes may be able to read the file.

The implementation also describes the storage as private, but it does not provide encryption, access-control validation, or explicit filesystem permission enforcement. Plaintext storage alone does not protect data from users or processes that can access the underlying file.

Attack Path

  1. A victim runs the skill and records private information.
  2. The _save() method writes the notes to quick_notes.json in plaintext.
  3. The execution environment creates the file with permissions derived from its current umask and parent-directory access controls.
  4. A local user or compromised process with filesystem access locates the skill directory.
  5. If the resulting permissions allow access, that actor reads quick_notes.json and obtains the stored note content.

Exploitation requires pre-existing local filesystem access and sufficiently permissive file or directory permissions. The reviewed code ...[truncated 529 chars]

Remediation
View remediation

Remediation Suggestions

  • Store notes in an operating-system-appropriate per-user data directory rather than beside the skill code.
  • Create the parent directory with permissions limited to the owning user, such as 0700 on POSIX systems.
  • Create the notes file atomically with owner-only permissions, such as 0600 on POSIX systems, rather than relying solely on the ambient umask.
  • Validate and correct existing file permissions when loading an already-created notes file.
  • Use authenticated encryption if the application intends to protect notes from users or processes that can read the underlying file.
  • Manage encryption keys through an operating-system credential store or another dedicated secret-management mechanism; do not hardcode keys in the skill.
  • Document the actual security boundary accurately and avoid describing plaintext local persistence as inherently private.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The skill name, description, and activation phrases are presented only in Chinese, which effectively constrains use to a specific language without any opt-in or explanation of a locale-specific requirement. This is a natural-language policy concern because users are not offered a language choice nor told that the skill is intended only for a Chinese-speaking context.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The activation phrases ("记一下 / 笔记 / 记个事") are common conversational terms and are likely to be triggered during normal speech rather than deliberate invocation. In a note-taking skill that persists data locally, accidental activation can capture private or unintended content and store it without clear user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill advertises local JSON persistence as 'private and reliable' but does not prominently warn users that notes are written to disk and may later be deleted or modified. This creates a transparency and privacy risk because users may disclose sensitive information without understanding its storage location, retention, or lifecycle.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.