Manage privypad notes

• Outcome: Review
• Latest audit: Sep 12, 2026 · 4:08 AM UTC
• Version: 1.0.0

Overview

This skill is a legitimate PrivyPad API helper, but it handles sensitive notes and deletion authority while giving conflicting guidance about zero-knowledge encryption and plaintext API examples.

Review this skill carefully before installing. Use it only with tokens you are comfortable giving to an agent, avoid placing real pp_ tokens in source files or logs, and require explicit confirmation before any deletion, especially permanent deletion. Clarify PrivyPad's encryption/API model before sending confidential notes through the documented examples.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:114

Finding

Plaintext Note Transmission and Unsafe Bearer Token Handling Contradict the Zero-Knowledge Security Model

Content

View full analysis

."; // supplied by user const BASE = "https://privypad.com/api/v1"; async function privypad(method, path, body) { const res = await fetch(`${BASE}${path}`, { method, headers: { "Authorization": `Bearer ${PRIVYPAD_TOKEN}`, "Content-Type": "application/json", }, body: body ? JSON.stringify(body) : undefined, }); if (!res.ok) throw new Error(`PrivyPad ${res.status}: ${await res.text()}`); return res.json(); } // Examples const notes = await privypad("GET", "/notes?pinned=true"); const note = await privypad("GET", `/notes/${id}`); const created = await privypad("POST", "/notes", { title: "Hello", content: "World" }); const updated = await privypad("PATCH", `/notes/${id}`, { isPinned: true }); await privypad("DELETE", `/notes/${id}`); const groups = await privypad("GET", "/groups"); ``` Python example at lines 146–153: ```python TOKEN = "pp_." # supplied by user BASE = "https://privypad.com/api/v1" HEADERS = {"Authorization": f"Bearer {TOKEN}"} def privypad(method, path, **kwargs): r = httpx.request(method, BASE + path, headers=HEADERS, **kwargs) r.raise_for_status() return r.json() # Examples notes = privypad("GET", "/notes", params={"group": "Work"}) created = privypad("POST", "/notes", json={"title": "Hi", "content": "There"}) updated = privypad("PATCH", f"/notes/{note_id}", json={"isPinned": True}) privypad("DELETE", f"/notes/{note_id}?permanent=true") groups = privypad("GET", "/groups") ``` Conflicting zero-knowledge claim at lines 164–166: ```text - **Zero-knowledge**: The server stores notes encrypted. The ...[truncated 3328 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill description instructs invocation for very broad cues like any mention of PrivyPad, a pp_ token, or generic note-management requests, which can cause over-triggering and unnecessary access to a highly sensitive notes API. In context, this is more dangerous because the skill handles bearer tokens that embed decryption capability, so accidental invocation could expose, modify, or delete private encrypted notes beyond the user's precise intent.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 84% confidence

Finding

The skill exposes a destructive endpoint that can delete notes, and the same section documents a hard-delete parameter. Even though deletion is a legitimate API capability, presenting it without mandatory confirmation or guardrails creates risk of prompt-induced destructive actions, especially because this tool operates on sensitive personal notes.

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

Delete / trash a note

text

DELETE /notes/:id

Add ?permanent=true to hard-delete instead of moving to trash.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 169)May include surrounding context.

md

- **Zero-knowledge**: The server stores notes encrypted. The token embeds the
  client-side secret needed to decrypt them. Never log or expose the token.
- **Trash vs. hard-delete**: `DELETE /notes/:id` moves to trash by default.
  Pass `?permanent=true` only when the user explicitly confirms permanent deletion.
- **HTML content**: The `content` field must be HTML, not Markdown. Use `<h1>`, `<h2>`,
  `<p>`, `<strong>`, `<em>`, `<ul>/<li>`, `<ol>/<li>`, `<hr>` etc.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

text

The token is created once in PrivyPad Settings and must be supplied by the user.
Never ask the user for their password — the token is self-contained.

Token management endpoints (`/api/tokens`) use the **session cookie** instead and
are only available in a browser context; do not attempt to call them from scripts.

Static analysis

No suspicious patterns detected.