ClawHub
Back to skill

Security audit

YoudaoNote

Security checks for vulnerabilities and agentic risk

Overview

The skill is purpose-aligned for YoudaoNote use, but its setup tells users to run an unverified remote installer directly in Bash, which needs review before installation.

Before installing, avoid running the pipe-to-Bash command as-is. Prefer a versioned package or download the installer separately, inspect it, and verify an official checksum or signature if available. Use a dedicated YoudaoNote API key if possible, avoid uploading secrets or regulated data, and assume note contents, clipped pages, URLs, and searches may be processed by YoudaoNote/NetEase.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:14
Finding

Unverified Remote Installer Executed Directly by Bash

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 14
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Complete Code Snippet:

sh
# Install (no Node.js required)
curl -fsSL https://artifact.lx.netease.com/download/youdaonote-cli/install.sh | bash

Technical Analysis

The installation instruction downloads a shell script from an external URL and streams it directly into Bash. The payload is executed immediately without being saved for inspection and without version pinning, checksum validation, or cryptographic signature verification.

Although installing the YoudaoNote CLI supports the Skill's declared functionality, direct execution of a mutable remote script is not the least-privileged or least-trust installation method. The reviewed project does not establish the endpoint's authenticity beyond HTTPS, nor does it constrain what the remote installer may do. HTTPS protects data in transit under normal conditions but does not protect against compromise of the hosting service, malicious changes by an authorized publisher, or failures in the DNS and certificate trust chain.

The effective executable payload can change after this Skill has been reviewed. Consequently, the behavior and privileges of the installer cannot be determined from the repository itself.

Attack Path

  1. A user or agent follows the setup instructions in SKILL.md.
  2. The shell requests install.sh from the external endpoint.
  3. The endpoint, publishing account, hosting infrastructure, DNS resolution, or TLS trust chain is compromised or serves an altered script.
  4. curl streams the attacker-controlled response directly to Bash.
  5. Bash executes the response with the privileges of the invoking user before the user can inspect or verify it.
  6. The payload may access user-readable files and credentials, alter shell configuration, replace local executables, download additional payloads, or e ...[truncated 1158 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace the curl | bash pipeline with a staged installation process that downloads the artifact without executing it:

    sh
    curl -fL -o youdaonote-install.sh \
  https://artifact.lx.netease.com/download/youdaonote-cli/install.sh

  2. Publish a versioned, immutable installer URL rather than a mutable install.sh endpoint.

  3. Publish the expected SHA-256 digest through an independently protected release channel and require verification before execution:

    sh
    echo "EXPECTED_SHA256  youdaonote-install.sh" | sha256sum --check -

  4. Prefer cryptographic release signatures with documented verification keys and key-rotation procedures.

  5. Instruct users to inspect the downloaded script before running it, then execute it as a separate command only after successful verification.

  6. Prefer a trusted package manager or a signed, version-pinned binary distribution where available.

  7. Document all files, directories, network destinations, and configuration entries created by the installer.

  8. Explicitly state that installation should occur without administrative privileges unless a narrowly defined operation requires them.

  9. Avoid printing or otherwise exposing the configured API key, and store it using restrictive permissions or an operating-system credential store.

  10. Provide reproducible release metadata so users can independently confirm that the downloaded artifact corresponds to audited source code.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The installation step fetches a remote script and immediately executes it with bash, giving the remote server full code execution on the local system at install time. If the distribution server, network path, or script contents are compromised, users can be infected without any opportunity to inspect or verify what will run.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

sh
# Install (no Node.js required)
curl -fsSL https://artifact.lx.netease.com/download/youdaonote-cli/install.sh | bash

# Configure API Key (get from https://mopen.163.com/#/dashboard)
youdaonote config set apiKey YOUR_API_KEY

Chaining Abuse

High
Category
Tool Misuse
Confidence
97% confidence
Finding

The explicit | bash chaining pattern removes inspection boundaries and encourages immediate execution of untrusted network content. In a skill meant to be followed by users or agents, this is especially dangerous because it normalizes a high-risk practice that can lead to arbitrary command execution if the fetched content is altered.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

sh
# Install (no Node.js required)
curl -fsSL https://artifact.lx.netease.com/download/youdaonote-cli/install.sh | bash

# Configure API Key (get from https://mopen.163.com/#/dashboard)
youdaonote config set apiKey YOUR_API_KEY

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill instructs users to use a third-party cloud note service but does not warn that note contents, search terms, clipped webpages, and source URLs will be transmitted to Youdao/NetEase infrastructure. In an agent skill context, this omission can cause users to unknowingly send sensitive data off-host to an external service, increasing privacy and data-handling risk.

Content

No source excerpt is available for this finding.