Security audit

Get笔记·六步抄作业版

Security checks across malware telemetry and agentic risk

Overview

This note-management skill is not plainly malicious, but it can scan broad private notes, save or delete content, and publish summaries to Feishu without clear enough per-action consent.

Install only if you are comfortable giving the agent access to Get笔记 credentials and potentially large portions of your notes. Require explicit confirmation for the target knowledge base, every write, any duplicate deletion, and every Feishu destination. Avoid enabling the Cron workflow unless you intentionally want broad recurring scans, local archives, Get笔记 report saves, and Feishu publication/notifications.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The Cron section materially expands the skill from Get笔记 knowledge management into a multi-system automation workflow that accesses local files, publishes to Feishu, and sends notifications. This broadens the trust boundary and creates opportunities for unintended data exfiltration, overcollection, and side effects far beyond what a user would reasonably expect from a Get笔记-focused skill.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: Creating Feishu docs/wiki pages and posting group notifications introduces external publication channels unrelated to the core stated function of Get笔记 management. If triggered, private knowledge-base content or summaries derived from it could be redistributed to broader audiences without clear consent, causing confidentiality and privacy breaches.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The Cron workflow reads from and writes to arbitrary local workspace paths that are outside the advertised Get笔记 API/CLI scope. Access to local memory files can pull in unrelated sensitive information, and local archival writes create persistence and data handling risks without clear user awareness.

Intent-Code Divergence

Medium

Confidence: 82% confidence
Finding: The documentation claims operations default to a single knowledge base, but the Cron rules require scanning all knowledge bases. This mismatch can mislead users about the scope of access and result in broader-than-expected collection of data across repositories, undermining consent and least-privilege expectations.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The activation phrases are broad enough to match ordinary requests about saving, searching, or organizing knowledge, increasing the chance that the skill runs in situations the user did not intend. In a skill that can scan multiple knowledge bases and write to external systems, over-broad invocation materially raises the risk of unauthorized or surprising actions.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: Single-word routing triggers like '整理', '搜', or '报告' are ambiguous and can map benign conversational text into privileged operations. Because this skill supports cross-KB aggregation and external side effects, ambiguous routing increases the likelihood of accidental execution and data handling beyond user intent.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill documents local file writes and external notifications but does not clearly warn users that their content may be persisted locally and redistributed to Feishu destinations. This lack of disclosure creates a consent and privacy problem, especially when summaries are generated from all knowledge bases and local memory sources.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill explicitly instructs saving recording summaries, freeform thoughts, and article/body content into a knowledge base, but it provides no warning about sensitive, personal, confidential, or third-party data handling. In a workflow designed for one-shot automation, users may paste transcripts, internal notes, or copyrighted content without realizing it will be persisted and potentially searchable later, creating privacy and data-governance risk.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The workflow directs the agent to save health-check reports and analysis outputs back into the knowledge base without warning that these derived artifacts may contain aggregated internal content, metadata, summaries of private notes, or structural information about the user's knowledge base. Persisting synthesized reports can amplify exposure because sensitive information from many notes may be concentrated into a single, easily retrievable document.

Ssd 3

High

Confidence: 99% confidence
Finding: The Cron workflow explicitly instructs broad aggregation of notes from all knowledge bases plus local memory files, then redistribution into local archives, Get笔记, Feishu docs/wiki, and group notifications. This is a classic overcollection-and-republication pattern that can expose sensitive internal content across multiple destinations with little or no per-destination consent.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.