Remarkable

• Outcome: Pass
• Latest audit: Jul 10, 2026 · 3:42 AM UTC
• Version: 1.0.0

Overview

This instruction-only skill matches its stated purpose of fetching and processing reMarkable tablet content, but users should tightly limit which notes an agent can access.

Install only if you want an agent to access selected reMarkable Cloud content. Prefer a dedicated sharing folder or explicit share tag, preview matches before downloading, review extracted handwriting before saving it to memory or project files, and protect or remove ~/.rmapi if you no longer want automatic cloud access.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill description encourages fetching and processing tablet content into memory, journals, or project files but does not clearly warn that private handwritten notes may be persisted locally. This can lead to unintended storage of sensitive personal or business information and increase the blast radius if local files are later indexed, shared, or reused by other workflows.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The setup section states that authentication saves a device token in ~/.rmapi but does not frame this as a security-sensitive persistent credential requiring protection. A locally stored cloud token can allow continued access to the user's synced documents if exposed through filesystem compromise, backups, or overly broad agent access.

Unrestricted Tool Access

Medium

• Category: Excessive Agency

Content

## Setup

- **Tool:** rmapi (ddvk fork) v0.0.32
- **Binary:** `~/bin/rmapi`
- **Config:** `~/.rmapi` (device token after auth)
- **Sync folder:** `~/clawd/remarkable-sync/`

• Confidence: 82% confidence
• Finding: The skill exposes a powerful cloud-sync tool and local sync directory without documenting scope restrictions, approval requirements, or guardrails on what content may be listed or fetched. In this context, unrestricted rmapi access can enable broad enumeration and retrieval of a user's notebook contents, which often contain sensitive handwritten material.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

rmapi cd "folder name"

# Find by tag / starred / regex
rmapi find --tag="share-with-gandalf" /
rmapi find --starred /
rmapi find / ".*sketch.*"

• Confidence: 95% confidence
• Finding: Using rmapi find with a root path of / allows broad search across the entire reMarkable cloud hierarchy based only on a tag filter. Even if intended for convenience, this pattern normalizes whole-account enumeration and can expose documents beyond the user's immediate intent, especially if tags are inconsistently applied or reused on sensitive notes.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# Find by tag / starred / regex
rmapi find --tag="share-with-gandalf" /
rmapi find --starred /
rmapi find / ".*sketch.*"

# Download (PDF)

• Confidence: 96% confidence
• Finding: rmapi find --starred / performs account-wide discovery of all starred items from the root, which can pull in unrelated or sensitive documents because starring is commonly used as a personal convenience marker rather than a secure sharing control. In a note-taking context, this makes accidental over-collection especially likely.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# Find by tag / starred / regex
rmapi find --tag="share-with-gandalf" /
rmapi find --starred /
rmapi find / ".*sketch.*"

# Download (PDF)
rmapi get "filename"

• Confidence: 97% confidence
• Finding: The regex search example rmapi find / ".*sketch.*" demonstrates unrestricted pattern-based enumeration from the account root. Regex-based discovery across all documents can surface unintended files and encourage overly broad matching that captures private notes, project names, or other sensitive content beyond the intended sketch workflow.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.