Security audit

bear-notes

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for managing Bear notes, but it asks users to install a mutable third-party CLI and store a Bear API token in a plaintext file without adequate protection guidance.

Review the grizzly CLI source and pin a trusted version before installing. Treat the Bear API token like a password: store it with owner-only permissions, avoid putting the real token directly in shell history, and rotate it if it may have been exposed.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:14
Finding: Unpinned Third-Party CLI Dependency## Vulnerability Details **File Location**: `SKILL.md`, lines 14-19 **Vulnerability Type**: Supply-chain risk caused by a mutable dependency version **Risk Level**: Medium **Vulnerable Code Snippet**: ```json { "id": "go", "kind": "go", "module": "github.com/tylerwince/grizzly/cmd/grizzly@latest", "bins": ["grizzly"], "label": "Install grizzly (go)", }, ``` ### Technical Analysis The installation configuration retrieves `github.com/tylerwince/grizzly/cmd/grizzly@latest`. The `@latest` selector is mutable, so the installed source may change after this Skill has been reviewed. The project does not pin a reviewed release or commit and does not provide an integrity checksum. This does not prove that the current upstream package is malicious. However, it creates a supply-chain trust boundary through which a compromised upstream repository, maintainer account, release process, or dependency could introduce arbitrary code into future installations without requiring any change to this Skill. ### Attack Path 1. An attacker compromises the upstream repository, a maintainer account, or an upstream dependency. 2. The attacker publishes a malicious version that is selected by `@latest`. 3. A user installs the Skill dependency through the documented installation mechanism. 4. The Go toolchain retrieves and builds the attacker-controlled source. 5. The malicious program executes when the user invokes `grizzly`, inheriting that user's local privileges and accessible environment. ### Impact Assessment Successful exploitation could result in arbitrary code execution under the installing or invoking user's account. The compromised CLI could access Bear note contents exposed to it, read the configured Bear token, modify notes, inspect other user-accessible files, or communicate data to an external service. The precise scope would be limited by the invoking user's operating-system permissions and macOS security contr ...[truncated 4 chars]
Remediation: ## Remediation Suggestions - Replace `@latest` with a reviewed, immutable release version or commit hash. - Prefer a versioned release obtained from a trusted source with documented provenance. - Record and verify expected checksums or signatures where the installation system supports them. - Review the selected release and its transitive dependencies before updating the pinned version. - Use an automated dependency-update process that requires review and security checks rather than silently tracking the newest release.

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:31
Finding: Bear API Token Written Without Explicit Permission Hardening## Vulnerability Details **File Location**: `SKILL.md`, lines 31-35 **Vulnerability Type**: Insecure local secret storage instructions **Risk Level**: Medium **Vulnerable Code Snippet**: ```markdown 1. Open Bear -> Help -> API Token -> Copy Token 2. Save it: `echo "YOUR_TOKEN" > ~/.config/grizzly/token` ``` ### Technical Analysis The documented command writes a Bear API token to a plaintext file without explicitly creating the parent directory securely or setting the token file permissions to owner-only access. The resulting mode depends on the existing directory permissions and the user's `umask`. In an insufficiently hardened environment, another local account or process may be able to read the token. The instruction also encourages users to substitute the actual token directly into an interactive shell command. Depending on shell configuration and history behavior, that command—and therefore the token—may be retained in shell history or other command-recording facilities. Plaintext storage may be required by the CLI's token-file interface, but the instructions should minimize exposure by enforcing restrictive directory and file permissions and by avoiding the inclusion of the secret in command-line text. ### Attack Path 1. A user replaces `YOUR_TOKEN` with a real Bear API token and runs the documented command. 2. The token is written using permissions derived from the user's current `umask`, or the command is retained in shell history. 3. A malicious local user or compromised process reads the token file or history entry. 4. The attacker supplies the recovered token to compatible Bear or Grizzly operations. 5. The attacker performs token-authorized operations against the victim's Bear data. Exploitation requires local access to readable files, shell history, or a process already operating in the user's security context. ### Impact Assessment Exposure of the Bear API token may permit unauthorized operations ...[truncated 312 chars]
Remediation: ## Remediation Suggestions - Create the configuration directory with owner-only permissions: ```bash install -d -m 700 "$HOME/.config/grizzly" ``` - Prompt for the token without echoing it or embedding it in shell command history, then create the file with mode `0600`: ```bash umask 077 read -r -s -p "Bear API token: " BEAR_TOKEN printf '\n' printf '%s\n' "$BEAR_TOKEN" > "$HOME/.config/grizzly/token" unset BEAR_TOKEN chmod 600 "$HOME/.config/grizzly/token" ``` - Document verification using `ls -l "$HOME/.config/grizzly/token"` and require that only the owner has access. - If supported by the CLI, prefer macOS Keychain or another operating-system credential store instead of a plaintext token file. - Advise users to rotate the Bear token if it has been entered into shell history or stored with permissive file permissions.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill explicitly instructs users to save a Bear API token to ~/.config/grizzly/token in plaintext, but it does not warn that this token is a sensitive credential or recommend restrictive file permissions. Any local user, malware, backup/sync system, or accidental disclosure of that file could expose the token and allow unauthorized Bear API actions such as modifying notes or enumerating note metadata.

Static analysis

No suspicious patterns detected.