Security audit

GNO

Security checks for vulnerabilities and agentic risk

Overview

This skill is a broad but clearly disclosed local knowledge/search integration; it is powerful and privacy-sensitive, but the reviewed artifacts do not show hidden, deceptive, or automatic unsafe behavior.

Install only if you want an agent to run the local gno CLI for your documents. Review collections before indexing private folders or session transcripts, prefer dry-run/project-scope/core/read-only modes, and avoid --force, --enable-write, daemon/session automation, or publish/export flows unless you explicitly intend those effects.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence

Findings (27)

Self-Modification

High

Category: Rogue Agent
Confidence: 93% confidence
Finding: The documented gno mcp install capability can overwrite existing client configuration when used with --force, creating a persistence and environment-modification path. In an agent skill marketed primarily for search, this is dangerous because it can silently alter downstream AI tool behavior and expand future access beyond the current session.
Content: Scanner excerpt · cli-reference.md (reported line 902)May include surrounding context.
md
| ---------------- | -------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `-t, --target` | claude-desktop | Target client (see below) | | `-s, --scope` | target default | Scope: `user`, `project` | | `-f, --force` | false | Overwrite existing config | | `--dry-run` | false | Preview changes | | `--enable-write` | false | Registered server starts with write tools enabled | | `--tool-profile` | full | Advertised tool set the registration starts with: `core` (7 read tools, plus `gno_capture` and `gno_remember` with `--enable-write`) or `full`; omitted writes no flag |

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · examples.md (reported line 344)May include surrounding context.
md
gno tags add gno://work/readme.md project/api # Remove tag gno tags rm gno://work/readme.md draft # Tags in frontmatter are extracted automatically cat myfile.md

Agent Config Directory Access

High

Category: Agent Snooping
Confidence: 90% confidence
Finding: Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
Content: Scanner excerpt · mcp-reference.md (reported line 65)May include surrounding context.
md
Installed entries deliberately pin the current Bun/package entrypoint, active index, absolute config, data directory, and model cache. Standard clients use `env`; OpenCode uses `environment`; Codex uses `~/.codex/config.toml` or project `.codex/config.toml` with `[mcp_servers.gno]` and `[mcp_servers.gno.env]`. Do not shorten a generated entry to `gno mcp`.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill metadata description is extremely broad and can match many ordinary user requests about files, notes, knowledge bases, past sessions, web UI setup, and search. In an agent-routing system, this increases the chance the skill is invoked in contexts broader than intended, exposing powerful local search/indexing capabilities and increasing the blast radius for privacy-sensitive retrieval.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The 'When to Use This Skill' section contains expansive triggers such as finding information, setting up MCP, starting a web UI, exporting for publishing, and recalling past agent sessions. These conditions are broad enough to route the agent into a capability-rich skill without sufficiently explicit user consent, which is especially sensitive because the skill can access local documents, archives, and potentially session data.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 83)May include surrounding context.
md
## Command Overview | Category | Commands | Description | | ------------ | ---------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------ | | **Search** | `search`, `vsearch`, `query`, `ask` | Find documents by keywords, meaning, or get AI answers | | **Links** | `links`, `backlinks`, `similar`, `graph`, `graph query` | Navigate document relationships and typed connections |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.
md
| ------------ | ---------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------ | | **Search** | `search`, `vsearch`, `query`, `ask` | Find documents by keywords, meaning, or get AI answers | | **Links** | `links`, `backlinks`, `similar`, `graph`, `graph query` | Navigate document relationships and typed connections | | **Retrieve** | `get`, `multi-get`, `ls` | Fetch document content by URI or ID | | **Index** | `setup`, `profile check/show/diff/apply`, `init`, `collection add/list/remove`, `index`, `update`, `embed` | Reproduce profile intent, prove retrieval, then maintain the index | | **Tags** | `tags`, `tags add`, `tags rm` | Organize and filter documents | | **Context** | `context add/list/rm/check/build/verify/watch/watches/reverify/unwatch` | Configure guidance or compile, verify, and watch saved evidence Capsules |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.
md
| **Index** | `setup`, `profile check/show/diff/apply`, `init`, `collection add/list/remove`, `index`, `update`, `embed` | Reproduce profile intent, prove retrieval, then maintain the index | | **Tags** | `tags`, `tags add`, `tags rm` | Organize and filter documents | | **Context** | `context add/list/rm/check/build/verify/watch/watches/reverify/unwatch` | Configure guidance or compile, verify, and watch saved evidence Capsules | | **Changes** | `changes`, `diff`, `impact` | Inspect bounded metadata history and dependency impact | | **Traces** | `trace list/show/label/export/replay/delete/purge` | Manage and replay private retrieval receipts | | **Models** | `models list/use/pull/clear/path` | Manage local AI models | | **Serve** | `serve`, `daemon` | One resident Web/headless gateway and watcher |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.
md
| **Changes** | `changes`, `diff`, `impact` | Inspect bounded metadata history and dependency impact | | **Traces** | `trace list/show/label/export/replay/delete/purge` | Manage and replay private retrieval receipts | | **Models** | `models list/use/pull/clear/path` | Manage local AI models | | **Serve** | `serve`, `daemon` | One resident Web/headless gateway and watcher | | **Publish** | `publish export` | Export gno.sh publish artifacts | | **Memory** | `remember`, `recall` | Fact-granular agent memory with explicit scopes and supersession | | **Sessions** | `sessions discover/init/source add/source remove/import/status/prune/automation` | Agent-session archive: manual import, opt-in hook/schedule automation |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.
md
| **Traces** | `trace list/show/label/export/replay/delete/purge` | Manage and replay private retrieval receipts | | **Models** | `models list/use/pull/clear/path` | Manage local AI models | | **Serve** | `serve`, `daemon` | One resident Web/headless gateway and watcher | | **Publish** | `publish export` | Export gno.sh publish artifacts | | **Memory** | `remember`, `recall` | Fact-granular agent memory with explicit scopes and supersession | | **Sessions** | `sessions discover/init/source add/source remove/import/status/prune/automation` | Agent-session archive: manual import, opt-in hook/schedule automation | | **MCP** | `mcp`, `mcp install/uninstall/status` | AI assistant integration |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 96)May include surrounding context.
md
| **Models** | `models list/use/pull/clear/path` | Manage local AI models | | **Serve** | `serve`, `daemon` | One resident Web/headless gateway and watcher | | **Publish** | `publish export` | Export gno.sh publish artifacts | | **Memory** | `remember`, `recall` | Fact-granular agent memory with explicit scopes and supersession | | **Sessions** | `sessions discover/init/source add/source remove/import/status/prune/automation` | Agent-session archive: manual import, opt-in hook/schedule automation | | **MCP** | `mcp`, `mcp install/uninstall/status` | AI assistant integration | | **Skill** | `skill install/uninstall/show/paths` | Install skill for AI agents |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 256)May include surrounding context.
md
were indexed but unseen old records were intentionally preserved; regenerate the export and rerun the command. | Export source | Activation | Logical record | Important boundary | | ---------------------------- | ------------------------------------------------------- | -------------------------------------- | -------------------------------------------------------------------------------------------------- | | JSONL/NDJSON | Automatic; optional `recordAdapters.jsonl.fieldMapping` | One object per line | Configure/map an ID for update-in-place identity; content-derived fallback edits become remove+add | | EML/MBOX | Automatic | One message | MIME/body bounded; attachments inventoried, never opened or indexed |

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 343)May include surrounding context.
md
Relaxing to `lan` or `remote` is a visible user-authorized write. Read the current revision with `get`, then use `gno collection policy set <collection> <policy> --confirm-relaxation <revision>`. Never invent or reuse a revision. Tightening to `local_only` needs no confirmation and invalidates active sessions, streams, and queued work. Bearer authentication, MCP write enablement, and collection policy are

Behavior Manipulation

Medium

Category: Prompt Injection
Confidence: 75% confidence
Finding: Subtle instructions detected that may alter agent decision-making or introduce hidden biases.
Content: Scanner excerpt · SKILL.md (reported line 411)May include surrounding context.
md
- MCP text is the compact `gno-context-agent-v2` evidence projection. It retains title/heading metadata, egress, each passage's content date and `supersededBy` (never present a superseded passage as current), configured guidance and its evidence bindings under explicit trust/boundary markers. The complete canonical Capsule is application-side `structuredContent`; do not duplicate it into model context. 3. Use `gno_ask` only for explicit local verified synthesis. Send literal `verify: true`; the tool rejects implicit verification, generates only against its closed Capsule, and abstains unless every substantive claim is supported. Preserve exact spans, gaps, semantic capability state, and abstention. This does not guarantee corpus completeness or source truth. 4. Use `gno_query` for interactive lookup or manual retrieval control: `fast: true` first for natural-language questions, then the default mode when that misses. It returns snippets plus `uri`, `docid`, often `line`, and sometimes `context`. Treat `context` as user-configured guidance for interpreting that exact result; cite source content at the returned URI/lines, not the guidance itself. Bounded graph expansion is on by default; set `graph: false` or `noGraph: true` only for an explicit BM25/vector-only path. 5. Use graph/link expansion for relationship context: `gno_graph_query` for typed relationship traversal, `gno_graph_neighbors` for nearby documents, `gno_graph_path` for "how are X and Y connected?", `gno_links`/`gno_backlinks` for one-document link expansion, and `gno_similar` for semantic neighbors. Prefer explicit or typed edges over inferred, ambiguous, or similarity edges when confidence matters. Plain `[[Note]]` links resolve across collections of the same vault (link workspace), so backlinks and impact can name other collections; pass `collection`/`collections` to keep results inside the user's scope. Never tell users to rewrite links into `[[collection:Note]]` to make them resolve. 6. Use `gno_q ...[truncated 25 chars]

Session Persistence

Medium

Category: Rogue Agent
Confidence: 76% confidence
Finding: The memory commands document persistent fact storage and replacement semantics, meaning an agent can write durable state that may influence later sessions. Persistent memory is not inherently malicious, but in a skill framed as local search it increases the risk of unnoticed retention of sensitive or incorrect information across sessions.
Content: Scanner excerpt · cli-reference.md (reported line 228)May include surrounding context.
Store one fact, or propose candidates without writing.

bash
gno remember "Prod deploys from main only" --scope project:gno # candidates only, no write gno remember "Prod deploys from main only" --scope project:gno --add # write a new fact gno remember "Prod deploys from release/*" --scope project:gno \ --supersede gno://memory/facts/... --predecessor-hash <hash> --json # replace a fact

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The sessions import and automation section describes ingesting local AI conversation archives and setting up automated imports, but it does not foreground the privacy sensitivity of those transcripts. Because session logs often contain secrets, credentials, internal code, and personal data, under-warning this capability increases the risk of over-collection and unintended retention.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The file documents commands to install MCP servers, modify external AI client configurations, install/uninstall skills, and overwrite existing config with --force, which goes well beyond a search-focused local knowledge tool. In an agent setting, this broad capability can enable persistent environment modification and expansion of tool access without users realizing the skill is no longer limited to search.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · cli-reference.md (reported line 898)May include surrounding context.
gno mcp install [options]

text
| Option | Default | Description | | ---------------- | -------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `-t, --target` | claude-desktop | Target client (see below) | | `-s, --scope` | target default | Scope: `user`, `project` |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · cli-reference.md (reported line 900)May include surrounding context.
md
| Option | Default | Description | | ---------------- | -------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `-t, --target` | claude-desktop | Target client (see below) | | `-s, --scope` | target default | Scope: `user`, `project` | | `-f, --force` | false | Overwrite existing config | | `--dry-run` | false | Preview changes |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · cli-reference.md (reported line 902)May include surrounding context.
md
| Option | Default | Description | | ---------------- | -------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `-t, --target` | claude-desktop | Target client (see below) | | `-s, --scope` | target default | Scope: `user`, `project` | | `-f, --force` | false | Overwrite existing config | | `--dry-run` | false | Preview changes |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · cli-reference.md (reported line 901)May include surrounding context.
md
| Option | Default | Description | | ---------------- | -------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `-t, --target` | claude-desktop | Target client (see below) | | `-s, --scope` | target default | Scope: `user`, `project` | | `-f, --force` | false | Overwrite existing config | | `--dry-run` | false | Preview changes | | `--enable-write` | false | Registered server starts with write tools enabled |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · cli-reference.md (reported line 903)May include surrounding context.
md
| `-t, --target` | claude-desktop | Target client (see below) | | `-s, --scope` | target default | Scope: `user`, `project` | | `-f, --force` | false | Overwrite existing config | | `--dry-run` | false | Preview changes | | `--enable-write` | false | Registered server starts with write tools enabled | | `--tool-profile` | full | Advertised tool set the registration starts with: `core` (7 read tools, plus `gno_capture` and `gno_remember` with `--enable-write`) or `full`; omitted writes no flag |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · cli-reference.md (reported line 904)May include surrounding context.
md
| `-s, --scope` | target default | Scope: `user`, `project` | | `-f, --force` | false | Overwrite existing config | | `--dry-run` | false | Preview changes | | `--enable-write` | false | Registered server starts with write tools enabled | | `--tool-profile` | full | Advertised tool set the registration starts with: `core` (7 read tools, plus `gno_capture` and `gno_remember` with `--enable-write`) or `full`; omitted writes no flag | Targets: `claude-desktop`, `claude-code`, `codex`, `cursor`, `zed`,

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · cli-reference.md (reported line 971)May include surrounding context.
md
`docs/CLI.md#long-running-processes` (kept in sync with this section on every release). | Flag | Purpose | | ------------------- | -------------------------------------------------------------------------------------------- | | `--detach` | Self-spawn a detached child; parent prints `pid` (+ `url` for serve) and exits 0. Unix-only. | | `--status` | Read pid-file, check liveness, print status. Pair with `--json` for machine output. |

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The CLI reference documents a publish/export workflow that prepares local content for upload to an external service (gno.sh), which exceeds the stated skill purpose of local document search/indexing. This scope expansion matters because an agent invoking the skill could facilitate data egress of sensitive local notes or documents under the guise of a search tool.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.