T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:74- Finding
Private note operations fail open when owner identity is not configured
- Content
View full analysis
- Remediation
View remediation
Security audit
GetNote
Security checks for vulnerabilities and agentic risk
Overview
This skill mostly matches its note-taking purpose, but it can read, change, and delete private notes while owner identity checking is optional and image uploads trust a server-provided destination.
Review before installing, especially if your agent is used in group chats or shared workspaces. Configure GETNOTE_OWNER_ID, use the skill only where the requester identity is reliable, treat deletes and tag/knowledge-base changes as account-level actions, and assume saved links, uploaded images, OCR text, and note contents are sent to Get笔记 for processing and storage.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/upload_image.py:76- Finding
User-selected images can be uploaded to an unvalidated server-provided destination
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (15)
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
该代码片段的实际功能非常狭窄，只是“图片资源上传”辅助脚本。它通过开放 API 获取上传 token，再将本地图片上传到对象存储，最后返回访问 URL。虽然这与声明中的“图片笔记”场景有关，且输出里提供了后续创建图片笔记的示例，但代码本身并未完成笔记创建，更没有实现声明中的绝大多数笔记管理、知识库管理、搜索、订阅和直播相关能力。因此，代码行为只覆盖声明中很小的一部分前置步骤，无法代表所宣称的完整技能描述，属于明显的描述与行为不匹配。
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill advertises many generic trigger phrases such as '记一下', '搜一下', and '找找', which are common in everyday conversation and can cause the assistant to invoke the skill when the user did not clearly intend to access or store private notes. In a note-taking skill with read/write access to personal data, over-broad activation increases the risk of unintended data creation, retrieval, or disclosure.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The README encourages saving links and images and notes that webpage content may be fetched and OCR may be performed, but the usage examples do not prominently warn that linked pages, uploaded images, and extracted text will be sent to the service for processing and storage. Users may therefore submit sensitive URLs or images without understanding the data-handling implications, creating privacy and confidentiality risk.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
方式三：手动安装
bash mkdir -p ~/.openclaw/workspace/skills/getnote cd ~/.openclaw/workspace/skills/getnote curl -sL https://raw.githubusercontent.com/iswalle/getnote-openclaw/main/SKILL.md -o SKILL.md curl -sL https://raw.githubusercontent.com/iswalle/getnote-openclaw/main/package.json -o package.json
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 85% confidence
- Finding
The skill declares no explicit tool restrictions despite requiring environment secrets and making outbound network requests, which weakens least-privilege enforcement and makes unintended tool use harder to govern. In an agent setting, broad implicit capabilities increase the blast radius if prompt routing or downstream behavior is abused.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger phrases are very broad and overlap with common conversational requests like '记一下', '搜一下', and '找找', which can cause accidental invocation of a skill that reads or writes private notes. In a privacy-sensitive skill, overbroad routing increases the chance of unintended access, storage, or disclosure of user data.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill metadata advertises very broad trigger phrases such as common note-taking and search requests, which could cause the agent to invoke this skill during ordinary conversation when the user did not clearly intend to use an external notes service. Because the skill can save text, links, images, and query knowledge-base content, over-triggering increases the risk of unintended data disclosure or modification of personal notes.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The title and the entire document content are written in Chinese, and there is no indication that language selection is optional or that the file is intentionally limited to a Chinese-speaking or region-specific audience. Under the policy, a skill artifact that effectively forces a specific language without opt-in can be a locale-policy violation.
- Content
Tainted flow: 'host' from requests.get (line 77, network input) → requests.post (network output)
Medium
- Category
- Data Flow
- Confidence
- 91% confidence
- Finding
The script takes the upload destination host directly from a remote API response and then POSTs the local image to that host without validating the domain, scheme, or trust boundary. If the token endpoint, DNS, or upstream service is compromised, the script can be coerced into exfiltrating arbitrary local image files to an attacker-controlled server, which is especially risky in a note-taking skill that may handle sensitive screenshots or documents.
- Content
python "Content-Type": mime_type, } files = {"file": (file_name, f, mime_type)} resp = requests.post(host, data=form_data, files=files) if resp.status_code not in (200, 204): raise Exception(f"上传失败: HTTP {resp.status_code}")
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python print(f"访问 URL: {image_url}") print() print("💡 创建图片笔记:") print(f' curl -X POST "https://openapi.biji.com/open/api/v1/resource/note/save?task_id=..."') print(f' -H "Authorization: $GETNOTE_API_KEY"') print(f' -H "Content-Type: application/json"') print(f' -d \'{{"type":"img_text","image_urls":["{image_url}"]}}\'')
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The skill name, description, and all invocation examples are written only in Chinese, with no indication that the user may interact in another language or choose a locale. This can be interpreted as a language policy constraint that is not explicitly optional or justified as region-specific.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The manifest description is entirely in Chinese and presents invocation phrases only in Chinese, with no indication that users can choose another language or locale. This may constitute a language/locale policy issue if the skill is intended for a broader audience and does not clearly document the locale restriction.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code file contains natural-language documentation and CLI help text exclusively in Chinese, which can constitute a language/locale policy issue when no opt-in or alternative language is provided. The file does not state that it is intended only for a Chinese-speaking or region-specific audience.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The argparse description, examples, error messages, and success output are all presented only in Chinese. Because the skill does not offer a language choice or explain a justified locale limitation, this is a natural-language policy concern under the language/locale rule.
- Content
Static analysis
No suspicious patterns detected.