Security audit

Ima Skill

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its IMA notes and knowledge-base purpose, but it has under-scoped network and update behavior that could expose credentials or let remote text steer the agent.

Review this skill carefully before installing. Use credentials with the least privileges available, avoid plaintext credential files where possible, do not set IMA_BASE_URL or pass baseUrl unless you fully trust the destination, and avoid importing URLs that could resolve to private or internal network resources.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: ima_api.cjs:119
Finding: Server-Supplied Update Instructions Can Hijack the Agent Session
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: ima_api.cjs:139
Finding: Caller-Controlled Base URL Can Exfiltrate IMA API Credentials
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: knowledge-base/SKILL.md:190
Finding: Arbitrary URL Download Workflow Enables SSRF and Upload of Retrieved Internal Data
Content: View full analysis
" | grep -i "^content-type:" | tail -1 | awk '{print $2}' | tr -d '\r') # 2. Download to a temporary directory TEMP_DIR=$(mktemp -d) curl -sL -o "$TEMP_DIR/paper.pdf" "" # 3. preflight-check.cjs ← GATE 1 PREFLIGHT=$(node .claude/skills/ima-skill/knowledge-base/scripts/preflight-check.cjs \ --file "$TEMP_DIR/paper.pdf" --content-type "$CONTENT_TYPE") # pass=false → terminate # 4. Follow the file-upload workflow ``` ### Technical Analysis The skill directs the agent to issue `curl` requests to an arbitrary URL and enables redirect following through `-L`. It does not validate: - The initial URL scheme. - The resolved destination IP address. - Redirect targets. - Loopback, link-local, private, multicast, or reserved address ranges. - DNS rebinding between validation and download. - Access to local management interfaces or cloud metadata endpoints. - Response size before downloading. - Whether the response body actually matches its declared content type. This creates server-side request forgery from the environment in which the agent runs. An attacker can cause the agent to access network resources that are not reachable from the attacker's own system. The subsequent preflight check does not inspect file magic or parse the downloaded file. It trusts a recognized HTTP `Content-Type`, so a private endpoint that returns or can be made to return an allowed type may have its response accepted as a PDF, text document, image, or another supported format. The workflow then uploads the downloaded bytes to COS and associates them with an IMA knowledge base. This can move data from an internal network boundary into cloud storage. ### Attack Path 1. An attacker supplies a URL as part of a requ ...[truncated 1906 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (25)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The activation criteria are extremely broad, including generic phrases like '帮我记一下' and common document/note intents. This can cause the skill to trigger in many unrelated conversations, unnecessarily exposing user content and credentials to a networked skill and creating opportunities for data exfiltration or unintended remote actions.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill declares network and environment-variable capabilities but does not bound them with an explicit tool scope such as permissions or allowed-tools. In practice, this leaves enforcement to prose and increases the chance the agent can access credentials or make unintended outbound calls beyond the intended IMA API flow.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.
md
1. **UTF-8 encoding (notes writes only):** Before calling `import_doc` or `append_doc`, ALL string fields (`content`, `title`) MUST be validated as legal UTF-8. Non-UTF-8 content causes irreversible garbled text. See [Detailed Rules](#detailed-utf-8-encoding-rules) for platform-specific methods. 2. **File upload naming:** `title` MUST equal `file_name` (with extension). Never rename, shorten, translate, or modify the original filename. 3. **Unsupported file types:** Reject immediately with a clear message. Do NOT ask user "do you still want to try?" Video files, Bilibili/YouTube URLs, and `file://` URLs are not supported — tell user to use IMA desktop client. 4. **File upload integrity:** Keep file content as-is during upload. No encoding conversion for binary files (PDF, images, Excel, etc.). 5. **PowerShell 5.1 (all modules):** If running in PowerShell, detect version before first API call. PS 5.1 silently converts request Body to GBK — must use UTF-8 byte array mode. See [Detailed Rules](#powershell-51-environment-detection).

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.
md
## 模块决策表 | 用户意图 | 模块 | 读取 | | ------------------------------------------------------------------------------------------ | -------------- | ------------------------- | | 搜索笔记、浏览笔记本、获取笔记内容、创建笔记、追加内容 | notes | `notes/SKILL.md` | | 上传文件、添加网页链接、搜索知识库、浏览知识库内容、获取知识库信息、获取可添加的知识库列表 | knowledge-base | `knowledge-base/SKILL.md` |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · notes/references/api.md (reported line 66)May include surrounding context.
md
## 模块决策表 | 用户意图 | 模块 | 读取 | | ------------------------------------------------------------------------------------------ | -------------- | ------------------------- | | 搜索笔记、浏览笔记本、获取笔记内容、创建笔记、追加内容 | notes | `notes/SKILL.md` | | 上传文件、添加网页链接、搜索知识库、浏览知识库内容、获取知识库信息、获取可添加的知识库列表 | knowledge-base | `knowledge-base/SKILL.md` |

Session Persistence

Medium

Category: Rogue Agent
Confidence: 93% confidence
Finding: The skill instructs users to persist long-lived API credentials in plaintext files under ~/.config/ima. Plaintext session or API-secret storage increases the risk of credential theft by other local processes, users, backups, or accidental disclosure, especially since these credentials enable authenticated API access.
Content: Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.
方式 A — 配置文件（推荐）：

bash
mkdir -p ~/.config/ima echo "your_client_id" > ~/.config/ima/client_id echo "your_api_key" > ~/.config/ima/api_key

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The function sends clientId and apiKey in outbound request headers to a remote service, which is a safety-relevant network operation involving credentials. This file contains no confirmation prompt, user-facing log, or inline warning near the transmission to disclose that credentials will be sent over the network.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill performs an undisclosed network-based self-update check and persists local state in the user's home directory, behavior that is not implied by the note/knowledge-base description. This expands the skill's actual capabilities beyond user expectations and introduces a control path where a remote service can influence execution flow by causing the skill to abort with an update-required condition.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · knowledge-base/SKILL.md (reported line 7)May include surrounding context.
md
## 接口决策表 | 用户意图 | 调用接口 | 关键参数 | | --------------------------------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------- | | 上传文件到知识库 | `check_repeated_names` → `create_media` → COS Upload → `add_knowledge` | `media_type`（按扩展名），`knowledge_base_id`，`file_name`，`file_size` | | 上传文件到知识库的某个文件夹 | 先定位文件夹 → 同上（`folder_id` 传入目标文件夹 ID） | 见「文件夹操作」章节 |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · knowledge-base/references/api.md (reported line 154)May include surrounding context.
md
## 接口决策表 | 用户意图 | 调用接口 | 关键参数 | | --------------------------------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------- | | 上传文件到知识库 | `check_repeated_names` → `create_media` → COS Upload → `add_knowledge` | `media_type`（按扩展名），`knowledge_base_id`，`file_name`，`file_size` | | 上传文件到知识库的某个文件夹 | 先定位文件夹 → 同上（`folder_id` 传入目标文件夹 ID） | 见「文件夹操作」章节 |

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly instructs downloading attacker-controlled external URLs with curl into a local temporary directory and then processing the file through subsequent tooling. Even though the file is later deleted, this still causes untrusted remote content to be fetched onto the local system, creating SSRF-like reachability, malicious file handling, and downstream parser/processing exposure without any documented trust boundary, allowlist, or safety checks on the source URL.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The documentation explicitly instructs callers to send long-lived API credentials (ima-openapi-clientid, ima-openapi-apikey) and later also describes handling returned access headers for media retrieval, but it provides no warning about treating these values as secrets. In an agent skill context, omission of secret-handling guidance increases the chance that credentials or privileged headers are logged, surfaced to users, or reused insecurely across requests, enabling unauthorized API access or data exposure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The quick-start workflow normalizes file upload and URL import into a remote knowledge base without any user-consent, privacy, or retention warning. In a skill that may be triggered from vague intents like '帮我记一下' or upload-related requests, this omission can cause users' files, notes, or URLs to be transmitted to third-party infrastructure and stored remotely without clear notice, creating privacy and compliance risk.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · knowledge-base/references/api.md (reported line 156)May include surrounding context.
md
| 值 | 名称 | content_type / 说明 | | --- | -------------- | ------------------------------------------------------------------------------------------------------------- | | 1 | PDF | `application/pdf` | | 2 | 网页 | N/A（直接 AddKnowledge，`web_info.content_id=<url>`） | | 3 | Word | `application/msword` / `application/vnd.openxmlformats-officedocument.wordprocessingml.document` | | 4 | PPT | `application/vnd.ms-powerpoint` / `application/vnd.openxmlformats-officedocument.presentationml.presentation` |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · knowledge-base/references/api.md (reported line 166)May include surrounding context.
md
| 9 | 图片 | `image/png`, `image/jpeg`, `image/webp` | | 11 | 笔记 | N/A（直接 AddKnowledge，`note_info.content_id=<doc_id>`） | | 12 | AI会话 | N/A（直接 AddKnowledge，`session_info.content_id=<session_id>`） | | 13 | TXT | `text/plain` | | 14 | Xmind | `application/x-xmind` / `application/vnd.xmind.workbook` / `application/zip` | | 15 | 录音 | `audio/mpeg`(mp3), `audio/x-m4a`(m4a), `audio/wav`(wav), `audio/aac`(aac) | | 16 | 视频解析 | **不支持通过 skill 添加**。Bilibili/YouTube/本地HTML等仅支持在 ima 桌面端内添加进知识库 |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · knowledge-base/references/api.md (reported line 467)May include surrounding context.
md
#### 返回字段（`data` 内） | 字段 | 类型 | 说明 | | ------------------- | --------------- | ------------------------------------------------------------------------------------------------- | | `media_type` | int32 | 媒体类型（见 MediaType 枚举） | | `url_info` | URLInfo | 访问链接信息，非笔记类型时填写（见 [URLInfo](#urlinfo访问链接信息)） |

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger guidance uses broad phrases like general 'search/find' wording for a privacy-sensitive notes capability, which can cause the agent to invoke the note-search API when the user meant a general conversation or non-note lookup. In this skill context, accidental invocation can expose notebook metadata or private note-derived results unnecessarily, making misrouting more dangerous than in a non-sensitive domain.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The note-listing trigger includes very broad phrases such as 'recent notes' or 'list notes' without sufficient scope constraints, so ordinary organizational requests may be interpreted as permission to enumerate private user data. Because notebook contents are sensitive, overbroad dispatch increases the chance of unintended disclosure of titles, summaries, and folder structure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The documentation exposes note creation and modification capabilities but does not require an explicit user warning or confirmation that the action will persist or alter personal data. For a privacy-sensitive notes system, missing write-safety UX increases the risk of unauthorized or accidental storage and modification, especially when combined with broad trigger phrases.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The create/import trigger includes generalized 'save/create' phrasing that can match ordinary assistant tasks, leading the agent to write user data into persistent storage without clear consent. In a notes skill, unintended persistence is a privacy and integrity risk because it may store sensitive content the user only wanted drafted or discussed transiently.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The append trigger is underconstrained and may fire on ordinary editing instructions, causing silent modification of an existing note. In this context, unintended appends can corrupt user records, inject sensitive conversational content into notes, or create auditability problems around what was actually authorized.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 74% confidence
Finding: The implementation loads clientId and apiKey from environment variables and files in ~/.config/ima/. While authentication may be operationally useful for calling the IMA API, the manifest does not mention credential handling or local secret-file access as part of the skill’s purpose, so this capability is not justified by the stated user-facing scope alone.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill emits Chinese-only natural-language messages such as the missing-credentials error, with similar Chinese strings elsewhere in the file. This imposes a specific language on users without opt-in or locale selection, which matches the language/locale policy violation criterion.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The code creates directories and writes the last update check date to ~/.config/ima/last_update_check, which modifies user state on disk. There is no prompt, log message, or nearby warning indicating that the skill persists this data locally.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: Natural-language policy requires avoiding forced language or locale constraints without user opt-in or clear justification. This skill documentation is entirely Chinese and does not state that the language is optional, user-selected, or limited to a justified region-specific context.
Content: No source excerpt is available for this finding.