Security audit

notes-sync-rich

Security checks for vulnerabilities and agentic risk

Overview

The notes download fits its purpose, but unsafe installation can overwrite unrelated local files and leave existing notes partially changed.

Use a disposable workspace until archive-link handling and recoverable installation are fixed. Confirm the configured endpoint with your administrator and keep a separate backup of existing notes before running.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/sync.sh
Finding: Archive-controlled sync-state symlink permits out-of-directory file overwrite
Content: View full analysis
Impact

The selected target is truncated and replaced with the sync-state JSON. This can corrupt unrelated user data or configuration. The replacement content is constrained by the marker format; arbitrary code execution is not established.

SkillSpector

Vulnerability Patterns

Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Bundle installation lacks an explicit warning that existing local notes may be overwritten.

Medium

Category: Output Handling
Confidence: 88% confidence
Finding: The workflow installs remote bundle contents into an existing notes directory without an explicit overwrite warning or a documented safeguard for local changes. Although synchronization implies replacement, invoking this skill for a backup or retention review makes the omission more dangerous: local notes could be overwritten before the archive stage preserves them. The actual overwrite behavior cannot be verified without scripts/sync.sh.
Content: No source excerpt is available for this finding.

Permission 'network' is declared but no corresponding code capability (network) was detected.

Low

Category: MCP Least Privilege
Confidence: 65% confidence
Finding: Declared permissions with no matching code capability may indicate removed functionality or pre-staging for future abuse.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.