ClawHub
Back to skill

Security audit

Siyuan Notes Skill

Security checks for vulnerabilities and agentic risk

Overview

This SiYuan notes skill is mostly coherent, but it handles private notes and credentials with a few review-worthy security gaps around remote HTTP use, broad Bash authority, and mutable installation instructions.

Review this skill before installing if your SiYuan server is remote or contains sensitive notes. Use HTTPS for any non-localhost SiYuan host, keep tokens out of URLs, avoid the mutable main-branch install command, and leave write mode disabled except when you intentionally want the agent to modify notes.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
index.js:780
Finding

SiYuan credentials and private note data may be transmitted over plaintext HTTP

Content
View full analysis
0; let authMode = requireAuth ? 'Token(header)' : 'No Auth'; if (hasBasicAuth) { headers.Authorization = basicAuthHeader.Authorization; authMode = 'Basic Auth'; if (requireAuth) { if (SIYUAN_ALLOW_TOKEN_IN_QUERY) { requestUrl += `${requestUrl.includes('?') ? '&' : '?'}token=${encodeURIComponent(SIYUAN_API_TOKEN)}`; authMode = 'Basic Auth + Token(query)'; } else { headers['X-SiYuan-Token'] = SIYUAN_API_TOKEN; authMode = 'Basic Auth + Token(header:x-siyuan-token)'; } } } else if (requireAuth) { headers.Authorization = `Token ${SIYUAN_AP ...[truncated 2932 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
README.md:27
Finding

Documentation permits installation of mutable, integrity-unverified upstream code

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (27)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 194)May include surrounding context.

md
const s = require('./index.js');

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 391)May include surrounding context.

md
const s = require('./index.js');

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 392)May include surrounding context.

md
const s = require('./index.js');

Lp1

High
Category
MCP Least Privilege
Confidence
96% confidence
Finding

The skill performs network access to the configured SiYuan server and to GitHub, but the finding indicates network capability is not covered by declared permissions. Undeclared network egress is risky because it can transmit note content, metadata, or credentials outside the expected sandbox without transparent consent.

Content

No source excerpt is available for this finding.

Lp1

High
Category
MCP Least Privilege
Confidence
96% confidence
Finding

The skill performs network access to the configured SiYuan server and to GitHub, but the finding indicates network capability is not covered by declared permissions. Undeclared network egress is risky because it can transmit note content, metadata, or credentials outside the expected sandbox without transparent consent.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · index.js (reported line 59)May include surrounding context.

js
function loadEnvFile() {
    try {
        // 始终使用当前JS文件所在目录下的.env文件
        const envPath = path.join(__dirname, '.env');
        if (fs.existsSync(envPath)) {
            const envContent = fs.readFileSync(envPath, 'utf8');
            envContent.split('\n').forEach(line => {

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill runs local shell commands via execSync to collect git metadata, which is not necessary for note management. Invoking a shell increases the risk of command-execution abuse, environmental manipulation, and unintended interaction with a hostile or untrusted working directory, even when the current commands are static.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · index.js (reported line 594)May include surrounding context.

js
1. 打开思源笔记
2. 进入 设置 → 关于
3. 复制 API Token
4. 创建 .env 文件并填入配置:

cp .env.example .env

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · index.js (reported line 596)May include surrounding context.

js
1. 打开思源笔记
2. 进入 设置 → 关于
3. 复制 API Token
4. 创建 .env 文件并填入配置:

cp .env.example .env

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · index.js (reported line 598)May include surrounding context.

js
1. 打开思源笔记
2. 进入 设置 → 关于
3. 复制 API Token
4. 创建 .env 文件并填入配置:

cp .env.example .env

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The manifest description is written as a Chinese-only invocation and usage policy, with no indication that users may interact in other languages or choose their preferred locale. This creates a natural-language locale constraint without opt-in or justification, which matches the policy-violation category for language/locale restrictions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The file presents all user-facing help and error guidance in Chinese only, effectively forcing a specific language for interaction. The policy allows locale constraints only when documented and justified or when the user is offered a choice, neither of which is present here.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · docs/Command-Reference.md (reported line 231)May include surrounding context.

printf 'new content' | SIYUAN_ENABLE_WRITE=true node index.js update-block {blockID}

text

Content via stdin only. If content parses as multiple blocks, automatically performs "first block update + subsequent inserts" with post-write verification.

---

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

该 markdown 文件从标题开始即以中文呈现完整命令参考，未说明这是可选语言版本，也未给出其他语言入口或用户选择方式。按规则，若技能在自然语言层面强制特定语言而没有用户 opt-in，属于语言/区域策略风险。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This markdown file contains user-facing instructions exclusively in Chinese, including headings, warnings, and operational guidance. Under the policy rule, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is explicitly justified, which is not stated here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The file-level natural-language description is entirely in Chinese and presents the skill as a general-purpose notes query tool, but it does not state that the skill is China/Chinese-specific or offer any language choice. Under the language/locale policy, forcing a specific language without user opt-in is a policy concern.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The version-check feature contacts GitHub releases/tags, which is unrelated to core note read/write operations and creates additional external egress. Even if it only sends a repo path and user agent, it increases attack surface, leaks usage metadata, and can be abused in restricted environments where the skill should only talk to the user's SiYuan instance.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

This code performs external transmission to api.github.com for release lookup, which is outside the primary SiYuan trust boundary. Third-party network calls can leak operational metadata and create unnecessary dependency on an external service, especially problematic for an agent skill handling private notes.

Content

Scanner excerpt · index.js (reported line 700)May include surrounding context.

js
}

async function getLatestTagFromGithub(repo) {
    const releaseUrl = `https://api.github.com/repos/${repo}/releases/latest`;
    try {
        const release = await fetchJson(releaseUrl);
        if (release && release.tag_name) {

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

This second GitHub tags request is another nonessential external egress path. Multiple fallback requests broaden network exposure and increase the chance of metadata leakage or policy violations in environments expecting purely local/private note operations.

Content

Scanner excerpt · index.js (reported line 710)May include surrounding context.

js
// ignore and fallback to tags
    }

    const tagsUrl = `https://api.github.com/repos/${repo}/tags?per_page=100`;
    const tags = await fetchJson(tagsUrl);
    if (!Array.isArray(tags) || tags.length === 0) {
        return '';

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

Line L03 states in Chinese that this file should be read by humans and directs certain LLMs elsewhere, effectively making the README Chinese-only for human readers without any opt-in or alternative locale. This is a natural-language locale policy concern because no language choice or multilingual option is offered.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

The manifest scopes this skill to operating on SiYuan notes (searching, reading, editing, organizing, tags, backlinks, daily notes, and SQL-style block queries). The exposed version-check command checks whether the skill itself is up to date, which is an operational/self-update capability not justified by the user's note-management intent.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
96% confidence
Finding

This handler invokes checkSkillVersion() and reports local/remote skill version status, which is about maintenance of the tool rather than interacting with SiYuan notes. That capability is not mentioned in the manifest and is not a direct requirement for searching, reading, editing, or organizing notes.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

The JS API warning, function descriptions, and gotchas in this section are written in Chinese, while the rest of the document is in English. This imposes a language/locale constraint on users consuming critical usage and safety guidance without any opt-in or alternative language option.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

This JavaScript file contains natural-language comments and user-facing return strings entirely in Chinese, such as '未知时间' and '查询结果为空', with no indication that the skill is region-specific or that users can opt into the locale. Under the stated policy, forcing a specific language without user choice or documented justification is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

This JavaScript file contains user-visible error strings such as "PMF 格式错误: block marker 缺少 id" and "PMF 解析失败: 未找到 @siyuan:doc 或 @siyuan:block 标记". That enforces a specific language in natural-language output without user opt-in or any indication that the skill is intentionally limited to a Chinese-speaking context.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.exposed_secret_literal

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
index.js:636

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
index.js:39

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
index.js:799