ClawHub
Back to skill

Security audit

Inkdrop

Security checks for vulnerabilities and agentic risk

Overview

This Inkdrop note skill is mostly purpose-aligned, but its helper script has a real local code-execution bug and weak safeguards around credentials and deletion.

Review before installing. Use only with a trusted local Inkdrop server, avoid remote INKDROP_URL values, do not store INKDROP_AUTH in normal project files, and avoid the included helper script until its Python argument handling and delete confirmation behavior are fixed.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/inkdrop.sh:19
Finding

Arbitrary Python Code Injection Through Untrusted Shell and API Data

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/inkdrop.sh:6
Finding

Basic Authentication Credentials Can Be Sent to an Unrestricted Plaintext Endpoint

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (12)

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

Verify connection:

bash
curl -s -u "$INKDROP_AUTH" "${INKDROP_URL:-http://localhost:19840}/"
# Returns: {"version":"5.x.x","ok":true}

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/inkdrop.sh (reported line 30)May include surrounding context.

sh
python3 -c "
import json, sys
print(json.dumps({'doctype':'markdown','title':'$TITLE','body':'''$BODY''','bookId':'$BOOK','status':'none','tags':[]}))" | \
    curl -s -u "$AUTH" -X POST "$BASE/notes" -H "Content-Type: application/json" -d @-
    ;;
  update)
    # args: noteId body

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill enables shell and network-capable workflows but does not declare any explicit tool scope or permissions boundaries. That increases the chance the agent can invoke broader capabilities than intended, especially for a note-taking skill that also supports destructive actions like deletion.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The activation description is overly broad and can cause the skill to trigger for generic note-taking, organizing, or task-management requests that may not specifically require Inkdrop. Overbroad triggering can lead to unnecessary access to local APIs and credentials, increasing the chance of unintended data reads, writes, or deletions.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

Verify connection:

bash
curl -s -u "$INKDROP_AUTH" "${INKDROP_URL:-http://localhost:19840}/"
# Returns: {"version":"5.x.x","ok":true}

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 103)May include surrounding context.

md
REV=$(curl -s -u $INKDROP_AUTH "http://localhost:19840/note:abc123" | python3 -c "import sys,json; print(json.load(sys.stdin)['_rev'])")

# 2. Update with _rev
curl -s -u $INKDROP_AUTH -X POST http://localhost:19840/notes \
  -H "Content-Type: application/json" \
  -d '{
    "_id": "note:abc123",

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill documents a direct delete operation for arbitrary document IDs without any warning, confirmation requirement, or guidance about irreversibility. In an agent context, this raises the risk of accidental or prompt-induced deletion of user notes, notebooks, tags, or attachments.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/inkdrop.sh (reported line 30)May include surrounding context.

sh
python3 -c "
import json, sys
print(json.dumps({'doctype':'markdown','title':'$TITLE','body':'''$BODY''','bookId':'$BOOK','status':'none','tags':[]}))" | \
    curl -s -u "$AUTH" -X POST "$BASE/notes" -H "Content-Type: application/json" -d @-
    ;;
  update)
    # args: noteId body

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/inkdrop.sh (reported line 43)May include surrounding context.

sh
python3 -c "
import json, sys
print(json.dumps({'doctype':'markdown','title':'$TITLE','body':'''$BODY''','bookId':'$BOOK','status':'none','tags':[]}))" | \
    curl -s -u "$AUTH" -X POST "$BASE/notes" -H "Content-Type: application/json" -d @-
    ;;
  update)
    # args: noteId body

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The delete command issues a DELETE request directly against the local Inkdrop API, which can remove user data irreversibly. While the file has brief usage comments, there is no confirmation prompt, warning message, or explicit disclosure near the destructive action itself.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

The script reads credentials from INKDROP_AUTH and passes them to curl with Basic authentication for multiple API calls. Although the environment variable is documented, the script does not clearly warn users at execution time that credentials and note data are being sent over HTTP to the configured endpoint.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The create path posts note content to the local HTTP API, and the update path later modifies existing note content, but the script provides no visible runtime notice that it is writing user data. The header comments describe usage and authentication, but they do not warn that these commands create or overwrite notes.

Content

No source excerpt is available for this finding.