Security audit

Xhs Note Analyzer

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a legitimate notes/API integration, but it handles sensitive note credentials and personal-note data with broad triggers and under-scoped network/file actions.

Install only if you trust the publisher and are comfortable granting access to your note account. Treat the API key as a secret, use a scoped key if available, review what note content, URLs, and images may be sent to the provider, and confirm before allowing deletes, updates, bulk actions, or remote-image downloads.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 85% confidence
Finding: The skill requires an environment variable API key and external network access, but the manifest does not explicitly declare these capabilities. This creates a transparency and governance gap: users or the platform may not realize the skill can access secrets and send data off-platform, which weakens permission review and trust boundaries.

Vague Triggers

Medium

Confidence: 76% confidence
Finding: Broad natural-language trigger phrases can cause accidental invocation during ordinary conversation. In a skill that performs network lookups using configured credentials, unintended triggering may cause unplanned external requests, unnecessary data disclosure to a third-party service, or unexpected API consumption.

Missing User Warnings

Low

Confidence: 72% confidence
Finding: The skill instructs users to configure an API key but does not warn that the key is sensitive or how it should be protected. This increases the chance of careless handling, such as sharing logs, screenshots, or configuration snippets that expose the credential and allow unauthorized third-party API usage.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The workflow directs the agent to fetch a remote URL from note metadata and write it to a local file via curl without requiring explicit user consent or validating the destination or source. This creates external network access and local file modification side effects, and if the coverImage field is attacker-controlled it could be abused for unexpected outbound requests or retrieval of untrusted content.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The workflow instructs the agent to inspect environment/config locations for an API key before proceeding, but does not include a privacy notice, minimization guidance, or restrictions on handling credential material. Accessing local credential sources without explicit consent increases the risk of over-broad secret exposure, especially in an agent context where users may not expect filesystem or environment inspection.

Static analysis

No suspicious patterns detected.