YouMind CLI

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:58 AM UTC
• Version: 0.1.0

Overview

This skill coherently helps agents use the YouMind CLI and API, with expected remote account actions and no artifact-backed deception or hidden local persistence.

Install this only if you intend to let the agent operate your YouMind account through the official CLI. Review write, publish, trash, install-skill, and scheduled-task requests carefully, avoid sending sensitive content unless you are comfortable with YouMind receiving it, and prefer a pinned or otherwise verified CLI version when installing.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:31

Finding

Unpinned Third-Party CLI Installation Creates a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 31-37
Vulnerability Type: Unpinned npm dependency installation
Risk Level: Medium

Vulnerable Code

markdown

This environment has already been validated.

Installed CLI:

```bash
npm install -g @youmind-ai/cli --prefix "$HOME/.local"

text

### Technical Analysis

The Skill documents installation of `@youmind-ai/cli` without specifying an exact version, lockfile, package integrity hash, or provenance-verification procedure. Consequently, the version resolved from the npm registry can change after the Skill has been reviewed.

npm package installation can execute package lifecycle scripts. If the package, publisher account, registry delivery path, or a future package release is compromised, following this instruction could execute attacker-controlled code under the account running the Agent. Describing the package as official does not provide a technical integrity guarantee.

The installation target is the user's local prefix rather than a system-wide directory, which limits the immediate privilege level. However, the installed program subsequently receives the `YOUMIND_API_KEY` and processes user content, so a compromised version would occupy a sensitive trust position.

### Attack Path

1. An attacker compromises the npm package publisher, package release process, or another part of the package-distribution chain.
2. The attacker publishes a malicious version of `@youmind-ai/cli`.
3. A user or Agent follows the documented unpinned installation command.
4. npm resolves the malicious version and may execute its lifecycle scripts during installation.
5. The malicious package executes with the privileges of the current user.
6. During installation or subsequent CLI use, it accesses local user data, intercepts `YOUMIND_API_KEY`, captures content supplied to YouMind operations, or alters API requests and responses.

### Impact Assessment

Suc
...[truncated 747 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the CLI to an exact reviewed version rather than resolving the latest release:

   bash

   npm install -g @youmind-ai/cli@<reviewed-exact-version> --prefix "$HOME/.local"
   

2. Record and verify the expected package integrity digest and package provenance before installation.

3. Verify the npm package owner, registry URL, signing or provenance metadata, and correspondence with the official upstream source repository.

4. Review package contents and lifecycle scripts before approving version updates.

5. Use --ignore-scripts where compatible, or explicitly document why lifecycle scripts are required.

6. Test upgrades in an isolated environment before changing the approved version.

7. Run the CLI with only the filesystem and network access required for YouMind operations.

8. Continue preferring environment-based authentication over command-line API-key arguments, and ensure credentials are scoped, rotated, and revocable.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

The skill is explicitly designed to create and manage persistent remote objects such as boards, notes, chats, skills, documents, slides, and scheduled tasks. Without strong activation boundaries and consent language, an agent could perform actions that outlive the session, creating unintended persistent state, surprise costs, or privacy issues for the user.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: youmind
description: Use this skill when working with YouMind through the official YouMind CLI and API. Trigger it for YouMind boards, notes, crafts, picks, materials, chats, documents, slides, skills, scheduled tasks, board content management, API discovery, schema inspection, or direct YouMind operations from OpenClaw. Especially relevant when the user wants to list or create boards, create notes, add URL materials, inspect board content, create documents or slides, interact with chats, manage YouMind skills, manage scheduled tasks, discover the correct API for a task, or call YouMind APIs safely.
metadata: {"openclaw":{"homepage":"https://github.com/cellinlab/cell-skills/tree/main/skills/youmind"}}
---

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger description is extremely broad and can cause this skill to activate for many YouMind-related requests, including ones where the user may not expect an external service call or persistent side effects. Over-broad activation increases the chance of unintended API discovery, data transmission, or write operations being suggested or executed in contexts that should have stayed local or required stronger confirmation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The guidance tells the agent how to authenticate and call YouMind APIs but does not clearly warn that prompts, notes, URLs, board contents, metadata, and other user-supplied material may be sent to a third-party service and stored remotely. This can lead to inadvertent disclosure of sensitive data because users may believe the action is purely local CLI usage rather than transmission to an external platform.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The short description is written in Chinese while the default prompt is written in English, and the file does not indicate whether the user can choose their preferred language. This can impose a language assumption without explicit opt-in, which matches the language/locale policy concern for natural-language content.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.