Ai好记

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:11 AM UTC
• Version: 0.1.0

Overview

The skill is mostly coherent for managing Ai好记 notes, but it needs Review because its setup and credential handling create avoidable security risk.

Review before installing. This skill can read note content and records, export notes, create or rename notebooks, delete notebooks, and move notes or notebooks through the Ai好记 API. Only use it with a least-privilege API key, protect ~/.aihaoji/config.json with user-only permissions if you store a key there, and avoid running the unpinned npx setup command unless you have verified the package/version you are executing.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:30

Finding

Unpinned Third-Party Package Is Downloaded and Executed Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 30
Vulnerability Type: Supply-chain exposure through unpinned package execution
Risk Level: Medium

Complete Code Snippet:

text

npx aihaoji-openclaw setup

Technical Analysis

The fallback setup procedure invokes an npm package through npx without specifying an exact version or integrity value. If the package is not already available locally, npx can retrieve it from the configured npm registry and immediately execute its entry point with the privileges of the current user.

Because the package version is not pinned, the code executed during setup can change after this Skill has been reviewed. A compromised publisher account, malicious future release, registry compromise, or dependency compromise could therefore turn the documented setup command into arbitrary local code execution. The audited project does not include the package source or provide a checksum that would allow the downloaded artifact to be verified.

Attack Path

1. An attacker compromises the aihaoji-openclaw package, its publisher account, or a transitive dependency used by a newly published version.
2. A user encounters automatic configuration failure and follows the documented fallback procedure.
3. npx resolves and downloads the current package version from the configured registry.
4. The downloaded package executes before the user can inspect its effective implementation.
5. Malicious installation or runtime code executes with the permissions of the user running the Agent.

Impact Assessment

Successful exploitation could execute arbitrary commands under the invoking user's account. This may permit access to files readable by that user, including the Aihaoji API configuration and other user credentials, modification of user-owned files, network communication, and installation of user-level persistence. It does not directly grant administrator privileges unl ...[truncated 114 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the package to a specific reviewed version, for example npx --yes aihaoji-openclaw@X.Y.Z setup.
• Verify the selected release, publisher identity, provenance, and transitive dependency tree before recommending execution.
• Use npm integrity metadata or a separately published trusted checksum where possible.
• Prefer installing from a documented official package scope and an explicitly trusted registry.
• Avoid automatically executing downloaded setup tools. Provide a manual setup procedure as the primary fallback.
• Run setup with ordinary user privileges and clearly warn users not to invoke it through sudo or another elevated context.
• Periodically re-audit the pinned version before updating the documented command.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:13

Finding

API Key Is Persisted in Plaintext Without Required File Permission Controls

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 13-30
Vulnerability Type: Insecure plaintext credential storage
Risk Level: Medium

Complete Code Snippet:

json

{
  "apiKey": "sk-sxxxxxxxx",
  "baseUrl": "https://openapi.aihaoji.com"
}

text

Authorization: $AIHAOJI_API_KEY

text

After obtaining the key, first call GET /agent-open/api/v1/auth/verify to validate it, and then write it to ~/.aihaoji/config.json.

Technical Analysis

The Skill directs the Agent to persist an Aihaoji developer API key in ~/.aihaoji/config.json. The instructions do not require use of an operating-system credential store, restrictive directory permissions, a 0600 file mode, secure atomic creation, or validation of permissions on an existing configuration file.

API keys are bearer credentials: possession of the value may be sufficient to authenticate requests. Plaintext storage is not inherently avoidable for every command-line integration, but storing the key without mandatory access-control safeguards increases exposure to other local users, unrelated processes, permissive backup systems, accidental synchronization, and diagnostic or support tooling.

The placeholder shown in the example is not itself a real secret. The vulnerability arises from the explicit instruction to write the user's actual key to the plaintext configuration file without defining secure handling requirements.

Attack Path

1. The Agent obtains a valid Aihaoji API key from the user.
2. The Agent writes the key to ~/.aihaoji/config.json as directed.
3. The file or its parent directory is created with permissions that permit access beyond the intended user, or it is later collected by backup, synchronization, or diagnostic software.
4. A local user or process reads and extracts the bearer credential.
5. The attacker sends authenticated requests to the Aihaoji API using the stolen key.
6. The attacker a ...[truncated 658 chars]

Remediation

View remediation

Remediation Suggestions

• Prefer storing the API key in an operating-system credential manager or dedicated secret store and keep only a credential reference in the configuration file.
• If file-based storage is necessary, create ~/.aihaoji with mode 0700 and config.json with mode 0600.
• Create the file atomically with restrictive permissions rather than writing it first and correcting permissions afterward.
• Reject or warn about configuration files owned by another user, symbolic links, and files with group or world access.
• Never print, log, or include the complete key in error messages, command history, telemetry, or diagnostic output.
• Redact the credential when displaying configuration and expose only a short non-sensitive suffix when identification is necessary.
• Inform the user before persistent storage and provide an environment-variable or session-only alternative.
• Document key revocation and rotation procedures and recommend granting only the minimum required API scopes.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

md

| 笔记详情 / 语义视图 / 导出 / 划线、批注、我的记录 | `GET /agent-open/api/v1/notes/{note_id}` |
| 新建笔记本 | `POST /agent-open/api/v1/folders` |
| 重命名笔记本 | `PUT /agent-open/api/v1/folders/{folder_id}` |
| 删除笔记本 | `DELETE /agent-open/api/v1/folders/{folder_id}` |
| 移动单篇笔记 | `PATCH /agent-open/api/v1/notes/{note_id}/folder`，请求体使用 `target_folder_id` |
| 批量移动笔记 | `POST /agent-open/api/v1/notes/batch-move` |
| 批量移动笔记本 | `POST /agent-open/api/v1/folders/batch-move` |

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest description says to use the skill when the user asks to "search, read, export, manage, move, or auto-classify" notes, including very broad verbs like "read" and "manage." It does not provide negative examples or narrower activation constraints, which could cause unintended invocation for generic note-related requests.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The skill instructs users to run npx aihaoji-openclaw setup without pinning a specific package version or integrity source. This creates a supply-chain risk: a future malicious or compromised package release could execute arbitrary code on the user's machine during setup, especially because the command is presented as the fallback remediation path for configuration.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The instruction to ask the user using fixed Chinese options ("A：导出为 Markdown 文件到本地 / B：直接在聊天里查看") indicates a language-specific interaction pattern. The file does not state that language choice depends on user preference or that the tool is region-specific, so this can violate language/locale policy expectations.

Content

No source excerpt is available for this finding.