ClawHub
Back to skill

Security audit

Personal Wiki

Security checks across malware telemetry and agentic risk

Overview

The skill mostly matches a personal wiki workflow, but it asks the agent to persist an Evernote token in the user's shell profile and can modify remote Evernote notes, so it needs human review before install.

Review before installing. Use this only if you are comfortable giving the agent access to your local ~/wiki files, IMA credentials, and Evernote token, and do not let it store tokens in ~/.zshrc unless you explicitly accept plaintext shell-profile persistence. Prefer setting the token only for the current session or using a secret manager, and require confirmation before any Evernote writeback or wiki cleanup changes.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill instructs reading and writing files under ~/wiki but does not declare permissions for those capabilities. This creates a trust and governance gap: users and platforms may authorize the skill under the assumption it is less privileged than it actually is. In a skill that also handles credentials and note ingestion, undeclared file access increases the chance of unintended data modification or exposure.

Tp4

High
Category
MCP Tool Poisoning
Confidence
76% confidence
Finding
The documented scope is broad, but the actual behavior described includes privileged actions outside a narrow visualization/query role, such as note modification and credential persistence. Description-behavior mismatch is dangerous because it misleads users and reviewers about what the skill will do, undermining informed consent and safe permissioning. In this context, the mismatch especially matters because the skill touches local files, remote note services, and secrets.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The manifest and user-facing description frame Evernote handling as ingesting specified notes, but the content also instructs writing back to Evernote notes and editing shell configuration. That is a material expansion of authority beyond read/ingest, and users may not expect content mutation or local environment changes from this skill. Because it combines remote content modification with local credential persistence, mistakes can have lasting effects.

Context-Inappropriate Capability

High
Confidence
96% confidence
Finding
The skill tells the agent to modify ~/.zshrc to persist EVERNOTE_TOKEN, which stores a sensitive credential in a long-lived shell profile. Persisting secrets in shell startup files increases exposure through accidental disclosure, backups, process inheritance, and future unrelated shell sessions. This is not necessary for a personal wiki skill's core purpose and broadens the blast radius of token compromise.

Missing User Warnings

High
Confidence
97% confidence
Finding
The skill directs the agent to proactively write a new EVERNOTE_TOKEN into ~/.zshrc without strong warning or explicit consent around persisting a sensitive credential. This normalizes insecure secret handling and could leak the token via shell history, backups, support bundles, or later environment exposure. In this context, the instruction is especially dangerous because it follows token expiry handling and encourages repetitive secret persistence as a convenience feature.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.