Bear Notes.Old

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:45 AM UTC
• Version: 1.0.0

Overview

This Bear Notes skill is a straightforward wrapper for the grizzly CLI, but users should review the third-party install and store the Bear token carefully.

Before installing, understand that this skill relies on a third-party grizzly CLI and may read or modify Bear notes when you invoke those commands. Prefer a pinned/reviewed grizzly version if possible, and create ~/.config/grizzly/token with owner-only permissions rather than typing the real token directly into a shell command.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:14

Finding

Unpinned Third-Party CLI Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 14–19
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

yaml

{
  "id": "go",
  "kind": "go",
  "module": "github.com/tylerwince/grizzly/cmd/grizzly@latest",
  "bins": ["grizzly"],
  "label": "Install grizzly (go)",
},

Technical Analysis

The installation configuration retrieves and compiles a third-party Go CLI using the mutable @latest version selector. No reviewed version, immutable commit, or integrity value is specified. Consequently, the executable installed in the future may differ from the dependency that was present when this skill was audited.

The installed CLI operates with the user's privileges and is expected to interact with Bear notes, local configuration files, and a Bear API token. A compromised upstream repository, maintainer account, or release process could therefore turn the dependency into an arbitrary-code execution channel.

This is a supply-chain risk rather than evidence that the current upstream package is malicious.

Attack Path

1. An attacker compromises the upstream repository, maintainer credentials, or dependency publication process.
2. The attacker publishes a malicious revision that becomes the version resolved by @latest.
3. A user installs the skill dependency after that revision is published.
4. Go retrieves and compiles the attacker-controlled package.
5. The resulting grizzly executable runs with the user's privileges when the skill invokes it.
6. The malicious executable can access data available to that user, including local Bear-related configuration and potentially the Bear API token.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the privileges of the user installing or invoking grizzly. The affected scope may include Bear note contents exposed during operations, the token stored under ~/.config/grizzly, and other ...[truncated 108 chars]

Remediation

View remediation

Remediation Suggestions

• Replace @latest with a reviewed, immutable semantic version or commit hash.
• Establish a controlled update process that reviews upstream changes before changing the pinned version.
• Document the expected upstream repository and maintainers so substitutions can be detected.
• Where the installation mechanism permits it, verify downloaded source or release artifacts using cryptographic checksums or signatures.
• Run the CLI with only the user permissions required for Bear integration and avoid invoking it from privileged contexts.
• Re-audit the dependency whenever the pinned version is updated.

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:40

Finding

Insecure Bear API Token Storage Instructions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 40
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Low

bash

echo "YOUR_TOKEN" > ~/.config/grizzly/token

Technical Analysis

The documented command writes the Bear API token to a plaintext file without explicitly setting restrictive directory or file permissions. The resulting permissions depend on the user's current umask; under a permissive configuration, another local account may be able to read the token.

Entering the real token directly as part of the command may also retain it in shell history. Although a token file is required by the declared CLI workflow, the instructions do not provide secure secret-entry or file-creation procedures.

Attack Path

1. A user replaces YOUR_TOKEN with a real Bear API token and runs the documented command.
2. The command may be recorded in shell history, including the plaintext token.
3. Alternatively, a permissive umask causes the token file or its containing directory to be accessible to another local account or process.
4. A local attacker reads the shell history or ~/.config/grizzly/token.
5. The attacker uses the recovered token with supported Bear API operations.

Exploitation requires local access or access through another process running on the same account or system.

Impact Assessment

Token disclosure could allow unauthorized use of Bear operations authorized by that token, including operations involving note data. The exact scope depends on Bear's token permissions and available callback operations. This issue does not independently provide operating-system privilege escalation, remote access, or persistence.

Remediation

View remediation

Remediation Suggestions

• Create the configuration directory with owner-only permissions:

  bash

  install -d -m 700 ~/.config/grizzly
  

• Collect the token without displaying it or embedding it in shell history:

  bash

  read -rsp "Bear API token: " BEAR_TOKEN
  printf '\n'
  

• Create the token file with mode 0600:

  bash

  umask 077
  printf '%s\n' "$BEAR_TOKEN" > ~/.config/grizzly/token
  unset BEAR_TOKEN
  chmod 600 ~/.config/grizzly/token
  

• Warn users not to place real tokens directly in command-line arguments or committed configuration files.
• Recommend periodically rotating the Bear token and immediately rotating it if shell history or file permissions may have exposed it.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.