Security audit

Siyuan Note Cli

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent note-management purpose, but it gives mutable note content instruction authority and repeatedly runs an unpinned npm CLI against local notes and tokens.

Review this skill carefully before installing. It should be changed to treat SiYuan note contents as data, not instructions; pin or preinstall a verified CLI instead of using bare `npx`; use unique private temp files with cleanup; and require explicit confirmation before broad reads, writes, deletes, or database changes.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:30
Finding: Untrusted SiYuan Note Content Is Treated as Mandatory Agent Instructions
Content: View full analysis
``` 3. If the guide contains Markdown rules, available tool lists, naming conventions, tag systems, database templates, or other instructions, follow them strictly. If "AI Assistant Guide" is not found, tell the user and continue with the normal operation. ``` From `references/workflow-examples.md:103-120`: ```markdown ## Workflow 5: Read "AI Assistant Guide" Before the User Task Every task that triggers this skill should follow this order: 1. Search for "AI Assistant Guide": ```bash npx siyuan-note-cli search docs "AI Assistant Guide" ``` 2. Read the guide: ```bash npx siyuan-note-cli document get ``` 3. Perform the specific user task according to the guide. ``` ### Technical Analysis The skill elevates the contents of a mutable SiYuan document into mandatory Agent instructions. It explicitly tells the Agent to follow instructions in the document “strictly” and perform the user’s task according to that document. SiYuan note content is external, mutable data and must not be assumed to have the same trust level as the skill definition or the user’s current request. No ownership validation, integrity check, trusted-document identifier, instruction allowlist, or precedence rule prevents note content from changing the Agent’s goals. This creates an indirect prompt-injection chan ...[truncated 1734 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:20
Finding: Unpinned npm Package Is Downloaded and Executed Through npx
Content: View full analysis
` to avoid environment differences. ``` Representative invocation from `references/commands.md:10-14`: ```bash npx siyuan-note-cli auth status npx siyuan-note-cli auth login --url http://127.0.0.1:6806 --token npx siyuan-note-cli auth logout ``` ### Technical Analysis The skill recommends executing `siyuan-note-cli` through `npx` without an exact package version, lockfile, integrity hash, reviewed artifact, or publisher verification. If the package is not already available locally, `npx` can retrieve executable package code from the configured npm registry at runtime. Consequently, the code executed during a skill invocation can differ from the code that was reviewed. A compromised package version, compromised maintainer account, registry substitution, or unsafe registry configuration could introduce arbitrary executable behavior. This is particularly sensitive because the CLI operates in an environment containing a SiYuan API token and can access or modify the user’s notes. ### Attack Path 1. The expected npm package or one of its transitive dependencies is compromised, or an attacker influences the npm registry used by the environment. 2. The legitimate global CLI is absent, causing the documented fallback to be used. 3. The Agent invokes `npx siyuan-note-cli` without a pinned version or verified integrity value. 4. `npx` downloads and executes the current registry-provided package. 5. Malicious package code runs with the privileges of the local Agent process. 6. The malicious code accesses environm ...[truncated 851 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/workflow-examples.md:11
Finding: Predictable Shared Temporary File Enables Symlink, Race, and Data-Leakage Attacks
Content: View full analysis
"Projects/2026-01-15-meeting-notes" \ --title "Meeting Notes" \ --file "$TEMP/siyuan-draft.md" ``` Always use `--file` instead of `--content` for Markdown content. `--content` can lose line breaks during shell parsing, turn `\n` into literal text, or corrupt special characters such as backticks, `#`, and `$`. Use `--content` only for very short single-line plain text. Recommended temp file handling: write to a system temp directory such as `$TEMP` or `/tmp`, with a fixed file name such as `siyuan-draft.md`. Each run overwrites the file, so manual cleanup is usually unnecessary. ``` ### Technical Analysis The workflow explicitly recommends a fixed, predictable filename in a shared system temporary directory and states that it should be overwritten on each run. Predictable temporary paths are vulnerable to pre-creation, symbolic-link attacks, race conditions, concurrent-task collisions, stale-content reuse, and unauthorized reading when permissions are not restrictive. For example, another local process can create `/tmp/siyuan-draft.md` as a symbolic link before the Agent writes the draft. Depending on how the writing operation is implemented and the account’s permissions, the Agent could overwrite a different file. Alternatively, an attacker can replace the draft between its creation and t ...[truncated 2118 chars]
Remediation: View remediation
document create \ "Projects/2026-01-15-meeting-notes" \ --title "Meeting Notes" \ --file "$draft" ``` ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (112)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The trigger description is broad enough to activate for many ordinary note-related or context-reference requests, which can cause the agent to access SiYuan notes more often than users may expect. Over-broad triggering increases the chance of unnecessary exposure of sensitive notes and unintended execution of the skill's command workflow.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill describes access to local notes and API-token-based authentication without a prominent user-facing warning that sensitive personal or organizational data may be read and modified. In practice, this can lead to users authorizing operations without understanding the confidentiality and integrity implications.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 78% confidence
Finding: The skill encourages writing task results to SiYuan and using notes as ongoing context, creating session persistence in a user data store. This can unintentionally retain sensitive prompts, outputs, or derived data beyond the immediate session, especially when combined with the mandatory reading of the local 'AI Assistant Guide' document.
Content: Scanner excerpt · SKILL.md (reported line 5)May include surrounding context.
md
name: siyuan-note-cli description: | Connect to and operate SiYuan Note through the siyuan-note-cli command-line tool, using notes as context for AI tasks. Use when the user asks to query, create, or modify SiYuan notes; read guides or knowledge bases from notes; manage notebooks, documents, blocks, or databases; write task results to SiYuan; or reference SiYuan notes during other work. After this skill is triggered, first read the note named "AI Assistant Guide" before performing the specific operation. Requires the local SiYuan Note client to be running and an API token to be configured. ---

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The skill repeatedly instructs the agent to invoke npx siyuan-note-cli without pinning an exact package version. npx may fetch the latest package at execution time, so a compromised upstream release, typosquat, or unexpected breaking change could result in arbitrary code execution in the agent environment while handling local notes and tokens.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: This line recommends npx siyuan-note-cli --version without a pinned version, allowing execution of whatever version npm resolves at runtime. In a skill that accesses local note data and API credentials, this creates a software supply chain risk with potential arbitrary code execution.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The startup workflow has the agent fetch and run an unpinned npm package before reading a local guidance document. Because the package is resolved dynamically, an attacker controlling the package or registry path could execute code prior to any workflow safeguards.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: This command uses npx siyuan-note-cli document get <doc-id> without version pinning. Since npx may download and execute code, even read-only note operations become a code execution vector tied to an external package supply chain.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The auth/login guidance references an unpinned npx package in a context where an API token may be entered on the command line. A malicious or compromised package version could steal credentials or alter configuration while appearing to perform normal authentication.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: Using npx siyuan-note-cli notebook list --format json without version pinning preserves the same package substitution risk. In this skill, the CLI is granted access to local note infrastructure, so arbitrary package changes can expose note metadata or pivot to broader local compromise.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: This notebook create command is another unpinned runtime package execution point. Attackers exploiting the package supply chain could create, alter, or exfiltrate note content and local configuration under the guise of routine operations.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The document creation example uses an unpinned npx package for a write operation, increasing risk because the executed code can both modify note contents and access temporary files. If the package is malicious, it can tamper with documents or read arbitrary local data from the same environment.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The recommended document create pattern still relies on unpinned npx, so every document write may execute newly resolved package code. Because the skill is intended for frequent note operations, the exposure is repeated and practical rather than theoretical.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: Even the 'avoid this' example embeds an unpinned runtime package call, which users may still copy. Security guidance that includes unsafe invocation forms can normalize insecure execution and lead to accidental adoption.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The block append example uses unpinned npx, again allowing arbitrary code execution through package resolution. Since block operations may be used repeatedly in loops or batch tasks, the skill encourages repeated trust in external mutable code.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: This second append example repeats the same supply-chain weakness. The local-note context makes it more dangerous because the executed package can read note contents, environment variables, and stored config containing API details.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The path example for document creation executes an unpinned npm package during content import from a local file. A compromised package can exfiltrate file contents, modify markdown before upload, or execute arbitrary system actions.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: This nested-path document creation example carries the same risk: mutable external code is executed while handling local content. Because the skill is operational and not merely educational, these commands are intended to be copied and run, increasing exploitability.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The auth status command still invokes an unpinned npm package. A malicious package could inspect existing auth configuration and tokens even if the command appears read-only.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The notebook list example relies on unpinned npx, repeating the same package integrity problem. Since the skill may browse user knowledge bases, even listing notebooks can reveal sensitive project names and structure to malicious code.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The notebook creation example executes unpinned external code with write privileges against the note system. This can be abused to create misleading content, stage persistence in notes, or exfiltrate metadata.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The document list example is another unpinned npx invocation. Because it enumerates document paths and structure, a malicious package could map sensitive data stores while operating under expected permissions.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: This document get sample instructs the agent to run mutable external code to retrieve document content. In context, retrieved notes may include sensitive instructions or secrets, which a compromised package could leak immediately.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The main document creation example again pairs unpinned runtime package execution with local file handling and write access. That combination materially raises impact because the package can read local files, alter note content, and access auth state in one step.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The rename command uses unpinned npx, which still grants arbitrary package code access to the local environment and note API. Simple administrative operations should not rely on mutable registry state at execution time.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The delete command is especially risky because it combines destructive capability with untrusted package resolution. A malicious or changed package could delete additional content, suppress prompts, or perform unrelated harmful actions on the host.
Content: No source excerpt is available for this finding.