reMarkable Tablet Sync

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:48 AM UTC
• Version: 1.0.0

Overview

This skill appears purpose-built for reMarkable tablet syncing, but it asks users to install mutable third-party tools and use a persistent cloud token for sensitive personal notes without enough safety guidance.

Review this carefully before installing. Use a dedicated environment if possible, verify or pin the rmapi binary and Python packages, protect ~/.rmapi as a credential file, and only sync notebooks you are comfortable exposing to local tools or downstream AI services.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

Unpinned and Unverified Third-Party Dependencies

SKILL.md:53

Vulnerability Details

File Location: SKILL.md, lines 53-68
Vulnerability Type: Unverified executable download and unpinned dependencies
Risk Level: High

The installation instructions download a mutable third-party executable and install Python packages without pinning versions or verifying cryptographic integrity.

bash

# Example for Linux amd64
curl -L https://github.com/ddvk/rmapi/releases/latest/download/rmapi-linux-amd64 -o ~/bin/rmapi
chmod +x ~/bin/rmapi

bash

pip install --user rmc cairosvg pillow

Technical Analysis

The rmapi executable is obtained through a mutable latest release URL. The downloaded file is made executable without validating a trusted checksum or digital signature. Consequently, the executable retrieved when a user installs the Skill can differ from the artifact that existed when the Skill was audited.

The Python dependencies are also installed without exact version constraints, hashes, or a lock file. Installation can therefore resolve to newly released package versions and transitive dependencies that have not been reviewed. Compromise of an upstream release, package registry account, repository, distribution channel, or dependency could result in attacker-controlled code being installed.

These commands run under the user's account. Although they do not request administrative privileges, the dependencies can access all files, credentials, and network resources available to that account.

Attack Path

1. An attacker compromises an upstream release, maintainer account, package, or transitive dependency used by rmapi, rmc, cairosvg, or pillow.
2. The attacker publishes a malicious artifact under the mutable latest release or an unconstrained package version.
3. A user follows the documented installation commands.
4. The malicious artifact is downloaded without checksum or signature verification.
5. The user executes rmapi, or Python loads ...[truncated 903 chars]

Remediation

Remediation Suggestions

1. Replace the mutable latest URL with an immutable, explicitly versioned release URL.
2. Publish the expected SHA-256 digest and verify it before granting execute permission:

   bash

   echo "EXPECTED_SHA256  rmapi-linux-amd64" | sha256sum --check -
   

3. Prefer verification using a trusted maintainer signature or provenance mechanism where available.
4. Pin all Python dependencies and their transitive dependencies to reviewed versions.
5. Use a lock file with cryptographic hashes, such as a hash-locked requirements file installed with:

   bash

   python3 -m pip install --require-hashes -r requirements.txt
   

6. Install Python packages in a dedicated virtual environment rather than the user's shared package directory.
7. Document the exact supported versions and establish a controlled process for reviewing and updating dependency pins.
8. Advise users to verify the source and integrity of downloaded artifacts before execution.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

• Confidence: 94% confidence

Finding

The skill explicitly encourages fetching handwritten notes, sketches, and journal entries and processing them with AI, but it never warns that this may expose highly sensitive personal content to the local agent, cloud sync path, or downstream AI tools. In this context, journals and handwritten notes often contain intimate, financial, medical, or work-confidential data, so omission of a privacy warning materially increases the risk of accidental disclosure.

External Transmission

Medium

• Category: Data Exfiltration

Content

bash

# Example for Linux amd64
curl -L https://github.com/ddvk/rmapi/releases/latest/download/rmapi-linux-amd64 -o ~/bin/rmapi
chmod +x ~/bin/rmapi

• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 91% confidence

Finding

The authentication steps state that a persistent cloud API token is saved to ~/.rmapi for future automatic use, but provide no warning about protecting that file. Anyone or any process with access to the host account could potentially reuse the token to access synced reMarkable content, making this a meaningful credential-handling weakness in a skill centered on personal documents.

Static analysis

No suspicious patterns detected.