Security audit

Siyuan Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly does what it says for SiYuan notes, but its optional vector indexing can expose note content and bypass or erase scoped indexes without enough safeguards.

Review before installing. Use this only with a SiYuan token you intend the agent to use, prefer whitelist mode, keep SiYuan, Qdrant, and Ollama on localhost unless you fully trust the remote services, and avoid running index --force or index --remove without an explicit scope. Do not rely on the current whitelist/blacklist settings to protect targeted indexing until that path is fixed.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: lib/embedding-manager.js:111
Finding: Raw Note Content Can Be Sent to an Unrestricted Embedding Endpoint
Content: View full analysis
a.trim()).filter(Boolean) : this.defaultConfig.embedding.skipIndexAttrs }; } ``` ```javascript // lib/embedding-manager.js:111-156 async request(endpoint, data = null, method = 'POST') { return new Promise((resolve, reject) => { const url = new URL(endpoint, this.baseUrl); const isHttps = url.protocol === 'https:'; const lib = isHttps ? htt ...[truncated 4129 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: lib/vector-manager.js:78
Finding: Document Metadata and Content Previews Can Be Replicated to an Unrestricted Qdrant Endpoint
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: commands/index-documents.js:37
Finding: Targeted Indexing Bypasses Notebook Whitelist and Blacklist Policies
Content: View full analysis
0) { const result = await this.fetchDocumentsByIds(skill, docIds); documentsToIndex = result.documents; skippedDocIds = result.skippedDocIds; } else if (notebookId) { const result = await this.fetchDocumentsByNotebook(skill, notebookId); documentsToIndex = result.documents; skippedDocIds = result.skippedDocIds; } else { const result = await this.fetchAllDocuments(skill); documentsToIndex = result.documents; skippedDocIds = result.skippedDocIds; } ``` ```javascript // commands/index-documents.js:202-219 async fetchDocumentsByIds(skill, docIds) { const documents = []; const skippedDocIds = []; for (const docId of docIds) { try { const docInfo = await skill.connector.request('/api/block/getBlockInfo', { id: docId }); if (!docInfo) { console.warn(`文档 ${docId} 不存在`); continue; } const result = await this.processDocument(skill, docId, { notebookId: null, updated: docInfo.updated }); if (result.skipped) { skippedDocIds.push(docId); } else { documents.push(...result.docs); } } catch (error) { console.warn(`获取文档 ${docId} 失败:`, error.message); } } return { documents, skippedDocIds }; } ``` ```javascript // commands/index-documents.js:226-244 async fetchDocumentsByNotebook(skill, notebookId) { const documents = []; const skippedDocIds = []; try { const sqlQuery = `SELECT id, content, path, updated, box FROM blocks WHERE box = '${notebookId}' AND type = 'd'`; const blocks = await skill.connector.request('/api/query/sql', { stmt: sqlQuery }); if (blocks?.length > 0) { for (const block of blocks) { try { ...[truncated 2920 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: commands/index-documents.js:226
Finding: Notebook Identifier Is Directly Interpolated into a Siyuan SQL Query
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (122)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: 该代码并不是在执行声明中强调的笔记本管理、文档创建/更新/删除、内容搜索或块控制等思源笔记CLI操作，而是专门进行文档到向量数据库的索引管理。它访问思源笔记API只是为了读取文档、属性、路径和块内容，核心行为是调用 vectorManager 对外部向量库进行批量索引、删除指定索引、清空集合、查询已索引更新时间及清理孤立索引，并且错误信息还明确提到 Qdrant 连接。这属于声明中未体现的实质性能力和不同的主要用途，因此描述与代码行为不符。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: 声明描述聚焦于思源笔记的 API CLI 操作，如管理笔记本、文档和块，以及搜索笔记内容。但实际代码块的核心功能是自然语言处理分析：检查 NLP 组件是否就绪，初始化后对任意输入文本做分词、实体抽取、关键词提取、摘要、语言识别及全量分析。代码中没有显示任何与思源笔记资源交互的行为，也没有文档、笔记本、块或搜索 API 调用。因此这不是对声明功能的实现细节补充，而是一个 materially different 的主要能力，属于描述与行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: 声明的核心用途与代码的主要方向大体一致，都是围绕思源笔记进行连接、文档与搜索操作。但代码明显实现了额外的、声明中未提及的重要能力：EmbeddingManager/VectorManager/NLPManager 的初始化与导出，hybridSearch、semanticSearch、keywordSearch、indexDocuments、nlpAnalyze 等接口，表明该技能不仅是普通的笔记/API/CLI 工具，还包含向量检索与 NLP 分析能力。这些属于实质性能力扩展，不只是实现细节，因此构成描述不足。另外，声明提到“块控制”，但此片段暴露的方法中没有直接体现块级管理接口；不过这更像声明可能过宽或代码片段不完整，次于前述未声明能力。综合判断为存在描述与行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 声明描述的核心能力应围绕思源笔记 API 的 CLI 封装，例如管理笔记本、文档和块、执行搜索等。但提供的代码片段完全没有调用思源笔记 API、没有 CLI 逻辑、没有笔记本/文档/块操作，也没有网络请求或命令处理。它只是一个用于中文分词或文本分析的本地词典数据与工具类。虽然词库中包含少量“思源”“笔记”“文档”等相关词汇，但这不足以说明其实现了声明中的笔记管理功能。因此该代码与声明用途存在明显且实质性的不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 代码块的核心功能与声明用途明显不符。声明描述的是一个面向思源笔记的 API 转 CLI 工具，预期应出现与思源笔记接口交互、笔记本/文档/块管理、搜索命令或 CLI 参数处理相关的实现。但实际代码仅实现中文分词相关逻辑：从词典中匹配词语、计算分词得分、过滤停用词、添加自定义词等。这不是对声明功能的辅助细节，而是完全不同的主要用途，因此应判定为描述与行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 声明描述的核心用途是思源笔记的 CLI/API 封装，用于笔记本、文档、搜索和块控制。但这段代码完全没有出现思源笔记相关接口、数据结构或管理逻辑，也没有文档 CRUD、笔记本管理、块操作等行为。相反，它专注于与 Ollama 嵌入接口通信并进行向量化与文本处理，这是与声明目标明显不同的主要功能，属于实质性描述不符。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: 声明描述的是较完整的思源笔记 API/CLI 管理工具，覆盖笔记本、文档、搜索和块操作多个领域；但给定代码片段只聚焦于块操作相关的自然语言意图识别与执行前参数组装。它不展示任何笔记本管理、文档级 CRUD、内容搜索实现，也没有实际 API 调用或 CLI 转换逻辑。虽然其中一部分与“块控制”相关，但代码的实际主要目的与声明的整体能力范围明显更窄且不同，因此属于描述与行为不完全一致的情况。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 声明描述的核心用途是操作思源笔记（API 转 CLI、笔记本/文档/块管理、内容搜索）。但实际代码仅是一个本地文本处理模块，不包含任何网络请求、CLI 命令封装、思源笔记 API 调用、笔记资源管理或搜索接口对接。其主要行为是分词、实体识别、关键词提取、摘要和语言检测，属于完全不同的功能域。因此描述与实际行为存在明显且实质性的用途不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 声明描述的是“思源笔记 API 的 CLI 工具”，重点应是对思源笔记本体进行笔记本、文档、块等 CRUD 和搜索操作。但该代码片段并未调用思源笔记 API，也未实现 CLI 层、笔记本管理、文档编辑或块控制。相反，它主要是一个独立的向量检索后端组件，专门与 Qdrant 交互并维护向量索引，属于与声明明显不同的核心功能。虽然其中处理的元数据字段包含 notebook/doc/block 概念，可能服务于思源笔记场景，但其实际能力是“向量数据库索引与搜索”，这属于未在声明中体现的实质性能力与主要用途偏移，因此应判定为描述与行为不匹配。
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The force-rebuild path can call clearCollection() and wipe the entire vector index when no notebookId or docIds are supplied. Because this destructive action is reachable from a normal command path and lacks scope restriction or confirmation, an accidental or manipulated invocation could destroy all indexed data and disrupt search functionality.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: clearCollection deletes the entire Qdrant collection and then rebuilds it, which is a highly destructive operation affecting all indexed data in the collection. Because there is no explicit safety interlock, confirmation, access control, or environment restriction, accidental or unauthorized invocation could wipe all search data and create prolonged service disruption.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill declares environment-variable requirements and optional networked integrations (SiYuan API, Qdrant, Ollama) but does not define any explicit tool scope such as allowed tools or permissions. That makes the runtime trust boundary unclear and can permit broader-than-expected network or secret access during execution, especially for an agent selecting skills automatically.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger description is broad enough to match common note-taking, document editing, and search requests, which increases the chance the agent invokes this skill in situations the user did not intend. Because the skill can modify, move, and delete content and may contact configured services, overbroad activation raises the risk of unintended data modification or disclosure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The command explicitly supports a --hide mode that bypasses the normal custom- prefix and allows direct modification of internal attributes, but it provides no additional confirmation, restriction, or policy check before performing the write. In a notes-management skill, internal attributes can affect document behavior, metadata integrity, or hidden state in ways the user may not fully understand, making accidental or unsafe modification materially more dangerous.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: User-facing strings and documentation in this command are entirely in Chinese, including the description, usage-related comments, and returned messages. This imposes a specific language/locale on users without any indication of language choice or opt-in, which matches the language-policy violation criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The user-facing natural-language strings in comments, logs, errors, descriptions, usage, examples, and option descriptions are all written in Chinese, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking environment. This creates a locale policy concern because the skill appears to enforce a specific language by default rather than offering opt-in or documenting a justified regional scope.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file’s user-facing description, usage context, log messages, and returned messages are entirely in Chinese, indicating the skill is designed to communicate in a fixed language. Under the policy, forcing a specific language without user opt-in or documented regional justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The file’s user-facing description and all returned messages are written exclusively in Chinese, and there is no indication that the skill is region-specific or that users can opt into another language. This can violate language/locale policy when skills are expected to avoid forcing a specific language without user choice.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The file’s natural-language documentation and all user-facing status/error messages are written in Chinese, including required usage feedback and deletion results. Because the skill does not offer a language choice or explain that it is intentionally limited to a Chinese-speaking context, it creates a locale policy concern under the language/opt-in rule.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The natural-language comments, command description, usage messaging, and returned user-facing strings are all exclusively in Chinese, with no indication that language selection is optional or that the skill is region-specific. Under the policy, forcing a specific language without user opt-in is a locale-policy concern.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The manifest describes a CLI for SiYuan note operations such as notebook management, document operations, search, and block control. This command's stated behavior is to index documents into a vector database, and the implementation initializes vector search, writes batches, deletes indexed data, and can clear the entire collection, which is a separate semantic capability not reflected in the manifest description.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The remove branch executes immediately and can trigger destructive deletion behavior without any confirmation or user-warning step. In an agent setting, missing confirmation increases the chance that ambiguous prompts, automation mistakes, or prompt-influenced tool calls result in irreversible loss of index data.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The SQL statement is built by directly interpolating notebookId into the query string, creating a classic SQL injection sink if notebookId can be influenced by a user or upstream agent. Since this query targets SiYuan internals, successful injection could expose or alter unintended records beyond the requested notebook scope.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The removeIndex implementation allows deletion of a notebook's entire index or the full collection with no safeguard, and the all-index path is especially destructive. In a note-management skill context, such broad destructive capability is more dangerous because users may expect document operations, not silent erasure of derived search data across the environment.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Comments, description strings, usage guidance, and user-facing error messages in this file are exclusively in Chinese. That can violate a language/locale policy when the skill does not provide user opt-in or clearly state that it is intended only for a Chinese-speaking or region-specific environment.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.