Security audit

SlonAide

Security checks for vulnerabilities and agentic risk

Overview

The skill’s note features are coherent, but its remote bridge setup runs unverified downloaded installer code, exposes secrets to that installer, and creates an auto-starting tunnel service.

Install only if you trust SlonAide/AideNote and specifically want the phone-to-local-OpenClaw bridge. Treat bridge setup as running external installer code on your computer and enabling a persistent remote tunnel; use a least-privilege API key, avoid custom installer or API URLs unless you control them, and rotate credentials if diagnostic output or logs may have captured key or token fragments.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

Location: src/bridge.js:48
Finding: Unverified Remote Installer Download and Execution
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: src/bridge.js:56
Finding: Unverified Installer Inherits All Process Environment Secrets
Content: View full analysis
Remediation: View remediation

T06 · System Persistence

Error

Location: src/bridge.js:38
Finding: Remote Bridge Establishes Cross-Session Login Persistence
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: src/tools.js:27
Finding: API Credentials Are Embedded in URLs and Partially Exposed in Output
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (34)

Context-Inappropriate Capability

Critical

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The tool downloads a shell or PowerShell installer from a remote URL and immediately executes it with bash or powershell.exe, giving the remote server full code execution on the user's machine. Because this installer sets up a tunnel/bridge to local services, compromise of the CDN, URL configuration, or installer content could lead to persistent arbitrary code execution and unauthorized remote access.
Content: No source excerpt is available for this finding.

Tp2

High

Category: MCP Tool Poisoning
Confidence: 85% confidence
Finding: Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill advertises note-management features but also instructs users to remotely download, install, and auto-start a bridge/tunnel service that enables remote connectivity to the local machine. That is a materially different and higher-risk behavior than the declared purpose, especially because it changes system state and exposes a local service through a relay.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The skill advertises note-management features but also instructs users to remotely download, install, and auto-start a bridge/tunnel service that enables remote connectivity to the local machine. That is a materially different and higher-risk behavior than the declared purpose, especially because it changes system state and exposes a local service through a relay.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill advertises note-management features but also instructs users to remotely download, install, and auto-start a bridge/tunnel service that enables remote connectivity to the local machine. That is a materially different and higher-risk behavior than the declared purpose, especially because it changes system state and exposes a local service through a relay.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The skill advertises note-management features but also instructs users to remotely download, install, and auto-start a bridge/tunnel service that enables remote connectivity to the local machine. That is a materially different and higher-risk behavior than the declared purpose, especially because it changes system state and exposes a local service through a relay.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This file adds tooling to install, start, and inspect a remote bridge service that enables a mobile app to connect to the local OpenClaw instance. That capability is materially broader than the stated skill purpose of recording transcription, note management, and semantic search, and it creates a network-accessible control path into the host environment.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The tool performs installation and execution of a remote bridge installer as soon as the tool is invoked, without an explicit user-facing warning describing that software will be downloaded, executed, and configured to auto-start. This deprives users of informed consent for a high-risk action that changes system state and may expose local services remotely.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The connection-test tool returns portions of the configured API key and bearer token directly in user-visible output. Even when partially redacted, credential fragments materially increase secret exposure risk, aid correlation across logs/screenshots, and are unrelated to the core note-management function. In this skill context, exposing auth material is especially dangerous because the same token is then used to access private note data from the remote service.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill description highlights transcription, summarization, semantic search, and remote API-backed processing, but the README does not clearly disclose that user audio, transcripts, and notes may be transmitted to external services for processing. For a recording-notes skill handling potentially sensitive meeting content, missing privacy disclosure can lead users to expose confidential or regulated data without informed consent.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: The README instructs users to run npx clawhub install slonaide without pinning a specific package version. This creates a supply-chain risk because npx will fetch and execute the latest published package at install time, so a compromised or malicious upstream release could execute arbitrary code on the user's machine.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README promotes installation of a remote bridge and states it will auto-start on login, but does not clearly warn that this process may download and execute external installer scripts. This is dangerous because users are being nudged to install persistent local software with remote connectivity, increasing the risk of unnoticed code execution, persistence, and compromise if the installer URL or distribution channel is ever tampered with.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 80% confidence
Finding: The skill exposes behaviors that imply network access, local file/config reads, and environment access, but it does not declare an explicit tool scope or permission boundary. That increases the risk of overbroad execution and makes it harder for users or the platform to understand and constrain sensitive actions such as reading local config or using secrets.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 84% confidence
Finding: Referencing npx clawhub install slonaide without a pinned version allows the fetched package or installer behavior to change over time, including supply-chain compromise or unexpected breaking changes. Users may execute whatever version is current at install time, reducing reproducibility and trust.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The bridge setup command is introduced in the quick-start flow without a strong up-front warning that it installs software and registers an auto-start service on macOS/Windows. Users may invoke it as a routine setup step without understanding the persistence and remote-access implications, increasing the chance of unsafe consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The bridge description explains installation mechanics but omits a prominent privacy and integrity warning that the feature enables remote connectivity from the AiDeNote App to the user's local OpenClaw instance. In a skill dealing with note data and local services, that omission is significant because it can expose sensitive content or local agent capabilities through a relay/tunnel path.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 88% confidence
Finding: The documented use of a LaunchAgent plist indicates persistence via auto-start for the tunnel service. Persistence is not automatically malicious, but in this context it supports a remote bridge service and should be treated as security-sensitive because it keeps remote-access functionality available across logins.
Content: Scanner excerpt · SKILL.md (reported line 126)May include surrounding context.
md
> tunnel disconnected: auth rejected: invalid token > ``` > > **解决方法：** 编辑 `~/Library/LaunchAgents/cn.aidenote.openclaw-tunnel.plist`， > 删除 `--token-endpoint` 及其后面的 URL 参数行，然后重启服务： > ```bash > launchctl bootout gui/$(id -u) ~/Library/LaunchAgents/cn.aidenote.openclaw-tunnel.plist

Session Persistence

Medium

Category: Rogue Agent
Confidence: 88% confidence
Finding: The instructions to restart the LaunchAgent reinforce that the skill relies on a persistent background service. For a bridge/tunnel component, persistent background execution expands the exposure window and can maintain remote connectivity longer than users expect.
Content: Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.
md
> **解决方法：** 编辑 `~/Library/LaunchAgents/cn.aidenote.openclaw-tunnel.plist`， > 删除 `--token-endpoint` 及其后面的 URL 参数行，然后重启服务： > ```bash > launchctl bootout gui/$(id -u) ~/Library/LaunchAgents/cn.aidenote.openclaw-tunnel.plist > launchctl bootstrap gui/$(id -u) ~/Library/LaunchAgents/cn.aidenote.openclaw-tunnel.plist > ```

Session Persistence

Medium

Category: Rogue Agent
Confidence: 88% confidence
Finding: Bootstrapping the LaunchAgent again confirms continued session persistence for the tunnel service. In combination with remote bridge functionality, persistence increases operational risk if the host, relay, or local agent is later misconfigured or compromised.
Content: Scanner excerpt · SKILL.md (reported line 130)May include surrounding context.
md
> 删除 `--token-endpoint` 及其后面的 URL 参数行，然后重启服务： > ```bash > launchctl bootout gui/$(id -u) ~/Library/LaunchAgents/cn.aidenote.openclaw-tunnel.plist > launchctl bootstrap gui/$(id -u) ~/Library/LaunchAgents/cn.aidenote.openclaw-tunnel.plist > ``` ### 6. 检查 bridge 状态

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The manifest presents the plugin as a recording-note assistant, but its configuration exposes remote bridge installation, tunnel binary download, relay host, and local gateway port settings. This capability mismatch increases the risk of deceptive functionality and enables remote code/script installation and tunneling behavior that could be abused for unauthorized access, persistence, or data exfiltration if the referenced URLs or backend are compromised.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This code file contains natural-language strings and comments exclusively in Chinese, including status messages, instructions, and help text. Under the policy, forcing a specific language without user opt-in is a language/locale policy violation unless the locale restriction is explicitly justified.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script places the API key directly in the URL path when requesting a token. Even over HTTPS, URL-based secrets are more likely to be captured in server logs, proxy logs, browser/history tooling, or monitoring systems than secrets sent in headers or request bodies. In a test utility, this is still risky because users are encouraged to pass live credentials on the command line and the script gives no warning about exposure paths.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 80% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/test_api.py (reported line 56)May include surrounding context.
python
} try: response = requests.post(list_url, headers=headers, json=payload, timeout=10) data = response.json() if data.get("code") == 200:

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The error message is presented only in Chinese, and the rest of the tool's user-facing descriptions and results are also Chinese-only. This imposes a specific language on all users without opt-in or documented regional justification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The code passes config.apiKey into the child process environment as AIDE_NOTE_API_KEY, handing a secret to a remotely fetched installer and any subprocesses it launches. Without clear disclosure and tighter handling, this increases the chance of credential leakage through process inspection, logs, child-process inheritance, or malicious installer behavior.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/bridge.js:173

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: src/bridge.js:57