Security audit

FadNote

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it claims, but it can automatically send highly sensitive secrets to a remote note service and documents unsafe command-line secret handling.

Install only if you are comfortable sending locally encrypted notes to the configured FADNOTE_URL service. Prefer piping content through stdin from a protected source, avoid putting passwords/API keys/private keys directly in command-line arguments, and require explicit confirmation before the agent creates notes for sensitive credentials.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/fadnote.js:31
Finding: Sensitive note content exposed through command-line arguments and shell history
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 96% confidence
Finding: The skill requires environment access and network communication but does not declare any explicit tool scope such as permissions or allowed-tools. In an agent ecosystem, that omission weakens reviewability and consent boundaries, making it easier for a skill that transmits sensitive user data to run with broader capabilities than users or the host expect.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The description emphasizes security properties but does not clearly warn users that their note content is still transmitted as ciphertext to a remote server endpoint. Even with client-side encryption, omission of that fact can mislead users about data flow, privacy expectations, jurisdiction, metadata exposure, and reliance on a third-party service.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The trigger phrases are broad enough to match ordinary user requests like 'share this securely' or 'secure this API key', which can cause the agent to automatically send highly sensitive content to an external service. Because this skill is specifically designed to handle secrets, overbroad activation materially increases the chance of unintended exfiltration of credentials, keys, or private data.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.