Security audit

Notelane

Security checks for vulnerabilities and agentic risk

Overview

Notelane is a disclosed local notes and productivity logging tool, with privacy and export-format caveats but no evidence of deception, exfiltration, privilege abuse, or unsafe automatic behavior.

Install only if you are comfortable with a local plaintext note logger. Avoid storing passwords, tokens, regulated data, or highly sensitive personal/work material, and be careful opening CSV exports in spreadsheet software. On shared machines, restrict permissions on ~/.local/share/notelane before use.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/script.sh:4
Finding: Note and Export Files Are Created Without Restrictive Permissions
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/script.sh:63
Finding: Unescaped Note Content Produces Unsafe JSON and CSV Exports
Content: View full analysis
"$out" local first=1 for f in "$DATA_DIR"/*.log; do [ -f "$f" ] || continue local name=$(basename "$f" .log) while IFS='|' read -r ts val; do [ $first -eq 1 ] && first=0 || echo "," >> "$out" printf ' {"type":"%s","time":"%s","value":"%s"}' "$name" "$ts" "$val" >> "$out" done < "$f" done echo "\n]" >> "$out" ;; csv) echo "type,time,value" > "$out" for f in "$DATA_DIR"/*.log; do [ -f "$f" ] || continue local name=$(basename "$f" .log) while IFS='|' read -r ts val; do echo "$name,$ts,$val" >> "$out"; done < "$f" done ;; ``` ### Technical Analysis The JSON exporter inserts log values directly into quoted JSON strings without escaping quotation marks, backslashes, control characters, or embedded newlines. A note containing JSON metacharacters can therefore terminate its intended string, alter the exported structure, or make the output invalid. The CSV exporter concatenates fields without RFC 4180 quoting. Commas, quotation marks, carriage returns, and newlines in note values can create additional rows or columns. In addition, spreadsheet applications may interpret fields beginning with characters such as `=`, `+`, `-`, or `@` as formulas. This creates a CSV formula-injection risk when an exported file is opened in spreadsheet software. Shell command injection does not occur at the shown `printf` and `echo` calls because the values are passed as quoted arguments. Exploitation occurs in downstream JSON parsers or spreadsheet applications that consume ...[truncated 1779 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The description partially matches only a subset of the code: the script does store text entries locally, has a 'tag' command, and provides text search. However, its primary behavior is broader and materially different from a personal knowledge-base note organizer. It functions as a general productivity/activity logging CLI with many specialized commands unrelated to note capture or knowledge-base management, plus export, stats, status, and history features that are undeclared. Because the implemented capabilities significantly exceed and shift the primary purpose beyond the declared description, this is a mismatch.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest limits the purpose to organizing notes with tagging and full-text search, but the file documents additional behavioral scope including planning, tracking, reminders, streaks, prioritization, timelines, reviews, and full export. This is a semantic expansion beyond a straightforward note knowledge-base skill.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Commands such as streak, remind, prioritize, timeline, report, and weekly-review introduce planner, reminder, and habit-tracking functions not implied by the manifest description. These are not obvious implementation details of tagging and full-text search.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest says the skill is for organizing notes as a personal knowledge base with tagging and full-text search. In code, the advertised interface centers on unrelated workflow commands like plan, track, streak, remind, prioritize, timeline, report, and weekly-review, which turn the tool into a general productivity logger rather than a note-focused knowledge base.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The export feature aggregates all stored content into new plaintext files without warning, increasing the number of copies of potentially sensitive notes on disk and making accidental disclosure more likely through local access, syncing, or backups. In this skill's context as a personal knowledge-base tool, exported data may contain concentrated sensitive information, so silent export materially raises privacy risk.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The main command handlers append raw user input into per-command log files like add.log, plan.log, track.log, and report.log. This behavior resembles category-specific activity logging, not organizing notes into a searchable tagged knowledge base as described in the manifest.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The script persists user-supplied content to files under ~/.local/share/notelane without an explicit upfront notice or consent flow, which can expose sensitive notes to other local processes, backups, or anyone with access to the user account. In a note-taking context, users may enter secrets, personal data, or work content assuming ephemeral handling, so silent persistence increases privacy and confidentiality risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The skill stores user-provided note contents persistently in plain-text local logs and supports export to plain-text formats, but the user-facing description does not prominently warn about the privacy implications. In a note-taking context, users may enter sensitive personal, work, or credential-adjacent information, making undisclosed plain-text retention and export a meaningful confidentiality risk.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.