Security audit

aispeech-ainote

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent integration for managing AIWork notes, todos, labels, knowledge search, and hotwords, with sensitive actions disclosed but requiring careful user control.

Install only if you trust the AIWork account connection and grant the minimum scopes you need. Because the skill can write and delete personal notes, todos, groups, labels, and hotwords, require the agent to show the exact target and get explicit confirmation before any delete or bulk-changing action, especially note group deletion.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill documents multiple destructive operations such as deleting todos, notes, and note groups, but it does not require explicit user confirmation before those actions are invoked. In an agent setting, ambiguous prompts, prompt injection, or mistaken entity resolution could cause irreversible or difficult-to-recover changes to a user's personal data.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The documentation exposes a destructive note deletion endpoint without requiring a confirmation step, preview of impact, or clear operator guidance to verify user intent. In an agent setting, ambiguous natural-language commands can lead to unintended deletion of user notes, and the installation token model makes such actions immediately effective once invoked.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The todo deletion endpoint is documented with no safety guardrails, confirmation language, or advice on validating the intended target before deletion. Because task names can be similar and agent actions may be driven by natural-language interpretation, this increases the risk of accidental loss or modification of a user's task state.

Missing User Warnings

High

Confidence: 97% confidence
Finding: This group deletion operation is more dangerous because the documentation explicitly states that the group and its child items enter the recycle bin, yet it lacks a prominent warning, impact summary, or confirmation requirement. In a note-management skill handling personal knowledge data, a mistaken deletion could affect entire collections of notes and nested content at once, making blast radius substantially larger than single-item deletion.

Static analysis

No suspicious patterns detected.