Note Taker

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 8:26 PM UTC
• Version: 2.0.1

Overview

This is a local note/task helper with some inconsistent labeling, but its storage and commands are disclosed and I found no hidden network, credential, persistence, or destructive behavior.

Install only if you are comfortable with a mixed note/task tool that stores task entries and command history locally. Avoid putting secrets, confidential meeting text, or private transcripts into it unless the chosen data directory is protected and appropriate for your machine.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill’s declared purpose is structured note-taking, but the documentation describes a different capability set centered on task and to-do management. This kind of purpose/behavior mismatch is dangerous because users, reviewers, or policy gates may trust the manifest and grant the skill access or approval under false assumptions, reducing informed consent and weakening security review.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The manifest advertises a note-taking assistant, while the body defines a task manager with reminders, priorities, history logging, export, and persistent storage. This is a substantive semantic discrepancy that can bypass user expectations and marketplace or automated checks that rely on metadata, making the skill more risky than it appears.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The manifest describes note-taking features such as Cornell notes, Zettelkasten, mind maps, meeting notes, and lecture notes. In contrast, the script presents itself as a 'Productivity and task management tool' and exposes task-oriented commands like done, priority, today, week, remind, stats, and clear, which are not note-organization behaviors.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: Presenting the skill as a note-taker while actively marketing it as a task management tool creates ambiguity about the real operational scope. In security terms, ambiguity increases the chance of inappropriate trust, incorrect deployment decisions, and incomplete review of storage, logging, and workflow capabilities.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: This shell script is a code file, so safety-critical data handling should include some form of user disclosure. Line L256 explicitly suggests using meeting content from audio transcription, which may contain confidential participant, business, or personal information, but the script provides no caution about sensitivity or reviewing/redacting content before sharing with an AI.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: For code files, missing user disclosures should be flagged when the skill handles potentially sensitive data. Line L321 encourages users to provide lecture content from audio transcription, but there is no warning about capturing personal data, copyrighted material, or ensuring permission to process recordings with AI.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The manifest frames the skill as a note-taking assistant, but the file comment and help output explicitly describe it as a 'Productivity and task management tool.' This is an active contradiction between documented intent and the declared skill purpose, not merely an omitted detail.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The _log function records user activity, including command context, to a history file without any clear interface warning. Because this creates an audit trail of user actions and possibly task content, it can leak sensitive behavioral or project information to other local users, support bundles, backups, or forensic collection.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: The description string is written bilingually and prominently includes Chinese text, but the file does not state that the skill is region-specific or that users can choose their preferred language. This can conflict with organizational language/locale expectations because the skill appears to impose a specific locale presentation by default.

Natural-Language Policy Violations

Low

• Confidence: 93% confidence
• Finding: Natural-language policy violations apply to all file types, including code comments and user-visible string literals. The help and command output consistently require Chinese-language interaction and do not offer language selection or note that the tool is intentionally limited to Chinese users, which can violate language/locale choice expectations.

Missing User Warnings

Low

• Confidence: 92% confidence
• Finding: The add command persists user-supplied content to a local file in the user's data directory without clearly warning that entries are stored on disk. In a note-taking or productivity context, users may enter sensitive personal, meeting, or credential-adjacent information, creating unintended privacy exposure on shared systems or in backups.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: SQP-3 applies to all file types and includes language or locale policy violations. This markdown content is written in Chinese from the main body onward, but it does not provide user opt-in, alternatives, or justification for restricting content to that language.

Static analysis

No suspicious patterns detected.