Evernote Note

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:57 PM UTC
• Version: 2.0.0

Overview

The skill appears to be a real Evernote/Yinxiang notes helper, but it asks for powerful note-account access and gives broad read/write/clip instructions without enough confirmation and scoping safeguards.

Install only if you are comfortable giving the skill access to your Evernote/Yinxiang account. Before using write or web-clip features, require the agent to restate the target note/notebook and ask for confirmation, avoid clipping sensitive or internal URLs, pin dependencies in a dedicated environment, and do not run the test scripts where terminal output may be logged.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:93

Finding

Unpinned Third-Party Dependencies and Mutable Installation Sources

Content

View full analysis

Vulnerability Details

File Locations:

• SKILL.md:93-97
• README.md:82-84
• README.md:129-130
• PUBLISH.md:56-58

Vulnerability Type: Unpinned dependencies and mutable package execution
Risk Level: Medium

Vulnerable Code

SKILL.md:93-97:

bash

pip3 install evernote2 oauth2

README.md:82-84:

bash

pip3 install evernote2 oauth2

README.md:129-130:

bash

npx skills add github.com/your-username/evernote-note-skill

PUBLISH.md:56-58:

bash

pip3 install evernote2 oauth2

Technical Analysis

The installation instructions retrieve third-party packages without pinning versions, hashes, immutable source commits, or verified release artifacts. Consequently, the code installed in the future may differ from the code reviewed during this audit.

Python packages may execute build or installation logic during installation. The npx command also invokes code obtained through the Node.js package ecosystem and uses an unresolved placeholder repository rather than a concrete, verified release. These behaviors create a supply-chain boundary in which package maintainers, compromised publisher accounts, registry infrastructure, transitive dependencies, or package-name confusion can alter the effective code executed by users.

The dependencies are relevant to the Skill's functionality, but allowing unrestricted future versions exceeds the minimum supply-chain trust necessary. Users only need a known-compatible, reviewed version.

Attack Path

1. An attacker compromises a dependency publisher account, upstream repository, registry response, or transitive dependency.
2. The attacker publishes a malicious version under one of the unpinned package names or causes an unsafe source to resolve through the placeholder installation instruction.
3. A user follows the documented pip3 install or npx command.
4. The package manager retrieves the current mutable ...[truncated 1020 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every direct dependency to an explicitly reviewed version, for example:

   bash

   python3 -m pip install "evernote2==REVIEWED_VERSION" "oauth2==REVIEWED_VERSION"
   

2. Maintain a locked dependency file that includes transitive dependencies.
3. Use package hashes, such as a hash-locked requirements file installed with:

   bash

   python3 -m pip install --require-hashes -r requirements.txt
   

4. Replace github.com/your-username/... with the actual verified repository and pin installation to an immutable commit digest or signed release tag.
5. Avoid automatic npx execution where a download-and-review or non-executing installation mechanism is available.
6. Document package provenance, reviewed versions, expected checksums, and the process for updating dependencies.
7. Recommend installation in a dedicated virtual environment with only the environment variables required for the immediate operation.

T09 · Insecure Skill Coding Practices

Note

• Location: test_evernote.py:22

Finding

Evernote Authentication Token Prefix Disclosed in Console Output

Content

View full analysis

Vulnerability Details

File Location: test_evernote.py:22
Vulnerability Type: Partial sensitive credential disclosure
Risk Level: Low

Vulnerable Code

python

print(f"✅ EVERNOTE_TOKEN: {os.environ['EVERNOTE_TOKEN'][:20]}...")

Technical Analysis

The validation script prints the first 20 characters of EVERNOTE_TOKEN. This is unnecessary to verify that the environment variable exists and causes credential metadata to be copied into terminal output.

Evernote developer tokens contain structured fields. A prefix may therefore expose account, shard, token-type, or expiration-related metadata rather than merely random masked characters. Although the displayed prefix is not shown to be sufficient for authentication by itself, it can be retained in CI logs, shell transcripts, screenshots, support tickets, or shared terminal sessions.

The disclosure violates the principle that authentication secrets should never be printed. Validation requires only checking whether the variable is present, not displaying any portion of its value.

Attack Path

1. A user configures a valid EVERNOTE_TOKEN.
2. The user runs test_evernote.py in a terminal, CI job, remote support session, or other logged environment.
3. The script writes the first 20 token characters to standard output.
4. The output is retained in logs, captured in a screenshot, or observed by another user.
5. An unauthorized party obtains token metadata that can be correlated with other leaked information or used to identify the account/token context.

Impact Assessment

This issue does not disclose the complete token and does not independently demonstrate account takeover. Its direct impact is limited to partial credential and account metadata exposure.

The risk increases when logs are public, broadly accessible, or combined with another partial leak. Because the full developer token can provide extensive access to the user's Evernote a ...[truncated 98 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove all token-value output and report only whether configuration is present:

   python

   print("✅ EVERNOTE_TOKEN is configured")
   

2. Do not log token prefixes, suffixes, structured fields, or lengths during normal validation.
3. If credential correlation is operationally necessary, generate a one-way fingerprint only after explicit user consent and avoid recording it in shared logs.
4. Configure CI and support tooling to redact EVERNOTE_TOKEN and YX_AUTH_TOKEN.
5. Advise users who have exposed token fragments in public logs to remove the logs and rotate the credential if broader disclosure may have occurred.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (31)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill is advertised as a full Evernote management workflow, but the file mainly contains setup snippets, connectivity checks, and illustrative code rather than a constrained implementation. This mismatch is dangerous because users and reviewers may assume vetted behavior while an agent improvises operations from prose, causing overbroad data access or unintended writes.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger phrases are extremely broad, including generic requests like 'help me remember this' or references to prior writing, which overlap with many everyday conversations. In a write-capable personal-notes skill, that can cause unintended activation, leading to unauthorized storage, retrieval, or disclosure of highly sensitive user content.

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · test_clipper.sh (reported line 20)May include surrounding context.

sh

BASE="https://app.yinxiang.com"

echo "=== 1. listNoteBooks (验证 token 有效) ==="
RESP=$(curl -s -X POST \
  "$BASE/third/ai-chat-note/grpc-api/search/listNoteBooks" \
  -H "Content-Type: application/json" \
  -H "auth: $YX_AUTH_TOKEN" \

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · test_clipper.sh (reported line 38)May include surrounding context.

sh

echo
echo "=== 2. clipAndSaveNote (剪藏 example.com) ==="
RESP=$(curl -s -X POST \
  "$BASE/third/clipper-gateway/restful/v1/clipAndSaveNote" \
  -H "Content-Type: text/plain" \
  -H "auth: $YX_AUTH_TOKEN" \

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown file presents all user-facing release and usage instructions only in Chinese. Under the policy rule for natural-language violations, forcing a specific language without user opt-in or a clearly documented regional justification is a reportable issue.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The document makes a broad privacy/safety claim that the skill 'will not store or transmit note content to third-party servers,' while elsewhere it explicitly introduces a RESTful Web Clipper flow that sends remote page content through Evernote/Yinxiang API infrastructure. This kind of contradictory disclosure can mislead users about what data leaves their environment, reducing informed consent and causing accidental exposure of sensitive URLs or captured content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README advertises clipping arbitrary URLs into the user's notes but does not clearly warn that this triggers external network access and persistent writes to the user's account. In an agent context, that matters because a user may not realize that supplying a URL can cause the skill to contact third-party hosts, retrieve untrusted content, and store it permanently under their credentials.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README presents contradictory authentication requirements: it says Web Clipper requires a separate Skills OAuth token, while elsewhere stating the skill only supports developer-token auth and no API Key/OAuth support. This ambiguity can cause users or agents to misconfigure credentials, potentially sending high-privilege tokens to the wrong workflow or assuming a sensitive network-write feature is available without understanding its auth boundary.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 47)May include surrounding context.

md

**国内版用户**：
访问：https://app.yinxiang.com/api/DeveloperToken.action

1. 点击"Create a developer token"
2. 复制生成的 token（格式类似：`S=s1:U=8f219:E=...`）
3. **妥善保管**，页面只显示一次

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 47)May include surrounding context.

md

**国内版用户**:
访问:https://app.yinxiang.com/api/DeveloperToken.action

1. 点击"Create a developer token"
2. 复制生成的 token(格式类似:`S=s1:U=8f219:E=...`)
3. **妥善保管**,页面只显示一次

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The FAQ says no API Key is needed for this skill, contradicting earlier text that Web Clipper needs a separate Skills OAuth token. For a skill that can fetch arbitrary URLs and write content into a user's Evernote account, misleading auth guidance increases the chance of unsafe deployment, accidental overtrust, and insecure token handling.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill documents use of environment variables and shell/curl execution, but it does not declare any explicit tool scope such as allowed-tools or permissions. This creates an authorization gap where a host agent may grant broader tool access than reviewers or users expect, increasing the chance of unintended command execution or secret exposure.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The activation and behavior description is entirely framed around Chinese-language product naming and trigger phrases, effectively constraining usage to a specific language/locale without any documented user opt-in or alternative. The file does not state that this locale restriction is optional or justified as a region-specific tool.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The metadata declares only EVERNOTE_TOKEN, while the clipping workflow also relies on YX_AUTH_TOKEN. This hidden credential dependency undermines reviewability and can cause agents to request or use undeclared secrets, making secret handling and permission boundaries less transparent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill advertises creation and modification of notes without making confirmation requirements explicit. Because these are state-changing operations against a personal knowledge base, an agent could write or alter records based on ambiguous user phrasing, causing data integrity and privacy issues.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

md

1. **获取印象笔记开发者令牌**：
   - 国内版访问：https://app.yinxiang.com/api/DeveloperToken.action
   - 国际版访问：https://www.evernote.com/api/DeveloperToken.action
   - 点击"Create a developer token"生成令牌
   - 复制生成的 token（格式类似 `S=s1:U=8f219:E=154308dc976:C=14cd8dc9cd8:P=1cd:A=en-devtoken:V=2:H=1e4d28c7982faf6222ecf55df3a2e84b`）

2. **配置环境变量**：

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

md

1. **获取印象笔记开发者令牌**:
   - 国内版访问:https://app.yinxiang.com/api/DeveloperToken.action
   - 国际版访问:https://www.evernote.com/api/DeveloperToken.action
   - 点击"Create a developer token"生成令牌
   - 复制生成的 token(格式类似 `S=s1:U=8f219:E=154308dc976:C=14cd8dc9cd8:P=1cd:A=en-devtoken:V=2:H=1e4d28c7982faf6222ecf55df3a2e84b`)

2. **配置环境变量**:

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The document says note bodies must not be shown in group-chat contexts, but earlier workflow guidance instructs reading full note content and converting it to plain text for return. This policy contradiction can lead an agent to disclose sensitive personal notes to unintended recipients, which is especially risky for a note-management skill handling private documents.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 86% confidence

Finding

The clipping workflow sends user-supplied URLs and authentication headers to an external Evernote endpoint via curl. External transmission is expected for this skill's purpose, but it still carries privacy and SSRF-style risk if arbitrary internal URLs, sensitive URLs, or unreviewed destinations are clipped without validation or user awareness.

Content

Scanner excerpt · SKILL.md (reported line 254)May include surrounding context.

https://app.yinxiang.com/third/skills-oauth/ 生成 Token 后保存为 YX_AUTH_TOKEN 环境变量。

实现： 用 Bash 工具直接 curl 印象笔记 RESTful API（不需要 Python，零依赖）：

bash

# 检查 token

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The document instructs callers to send a live authentication token in two HTTP headers and even describes the token format, but provides no guidance on secure storage, redaction, rotation, or log handling. In a skill context, this increases the chance that implementers expose credentials in source, telemetry, debugging output, or prompts, which could enable unauthorized access to a user's Evernote account.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest describes support for searching notes, browsing notebooks, getting note content, creating notes, appending content, and web clipping. However, this reference file also documents deleting notes (L240-L257) and creating notebooks (L279-L296), which are materially broader operations than the declared skill behavior. This creates a semantic mismatch between the advertised scope and the capabilities presented as part of the skill API surface.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The deleteNote example shows a destructive operation with no mention of confirmation, reversibility, or user-consent safeguards. In an agent skill context, examples often shape implementation behavior, so this omission can normalize unsafe deletion flows and increase the risk of accidental or unauthorized data loss.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · test_clipper.sh (reported line 20)May include surrounding context.

sh

BASE="https://app.yinxiang.com"

echo "=== 1. listNoteBooks (验证 token 有效) ==="
RESP=$(curl -s -X POST \
  "$BASE/third/ai-chat-note/grpc-api/search/listNoteBooks" \
  -H "Content-Type: application/json" \
  -H "auth: $YX_AUTH_TOKEN" \

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script performs a state-changing operation that creates a new note in the user's Evernote/Yinxiang account, but the only indication is an inline echo right before execution. For a test script, silently creating persistent account data can surprise users, cause unintended content creation, and normalize unsafe behavior around destructive or stateful API testing.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.