Security audit

Note

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local note-capture tool with some privacy and completeness caveats, but its file access is disclosed and aligned with its purpose.

Install only if you are comfortable with notes being saved locally in plaintext under your OpenClaw workspace. Avoid storing secrets or highly sensitive personal data, and use explicit note-taking commands so ordinary conversation is not accidentally persisted. Be aware that captured note previews may appear in logs.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/capture_note.py:21
Finding: Private Notes Are Stored Without Explicit Filesystem Permission Hardening
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/capture_note.py:57
Finding: Sensitive Note Content Is Exposed Through Standard Output
Content: View full analysis
80 else ''}") ``` ### Technical Analysis After capturing a note, the script prints up to the first 80 characters of its content to standard output. Note text may contain confidential personal, business, authentication, or meeting information. Standard output is frequently captured by agent execution frameworks, terminal logging systems, CI infrastructure, process supervisors, or centralized telemetry. Consequently, note fragments can be retained outside the documented local notes directory even though `SKILL.md` states that notes are stored locally and are not shared. No attacker-controlled code execution is required. Exposure occurs whenever an execution environment records or forwards stdout. ### Attack Path 1. A user captures a note containing sensitive information within its first 80 characters. 2. The script prints that fragment to standard output. 3. The surrounding agent runner, terminal recorder, process supervisor, or logging platform captures stdout. 4. A person or service with access to those logs retrieves the note fragment outside the intended note-storage boundary. ### Impact Assessment The issue can disclose up to 80 characters from each captured note, potentially exposing names, project information, personal data, or secret values. The affected scope is limited to the printed fragment and environments that capture or expose stdout. The vulnerability does not provide additional system privileges, code execution, or direct access to the complete notes database. ]]>
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The code is consistent with part of the declared description: it captures notes and stores them locally. However, most of the broader claimed behavior is not present in this chunk. There is no retrieval mechanism, no surfacing of relevant notes, and no logic to connect related ideas. Automatic organization is very limited: topics are only populated from the provided project field, not inferred broadly from note content or context. Therefore the supplied code chunk materially underimplements the declared knowledge capture and connection system, making the description inaccurate for this code.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill instructs the agent to read and write local files under memory/notes/, but it does not declare any permissions or allowed-tools scope. That creates an authorization ambiguity where file system access may be broader than the user or platform expects, increasing the risk of unintended note access, overwrite, or data exposure if the skill is invoked in the wrong context.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The activation language is very broad: phrases like taking notes, capturing ideas, recording insights, or finding previous notes are common in ordinary conversation. In a skill with local file read/write behavior and access to potentially sensitive personal notes, ambiguous triggering can cause unintended invocation, silent persistence of user data, or retrieval of prior notes in contexts where the user did not clearly consent.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.