happy-notes

• Outcome: Review
• Latest audit: May 28, 2026 · 12:36 PM UTC
• Version: 1.0.0

Overview

This appears to be a real iflow knowledge-base helper, but it needs review because it can automatically store, share, generate from, and delete knowledge-base content with broad triggers and weak confirmation guidance.

Install only if you trust the publisher and are comfortable giving the skill an iflow API key plus authority to upload, store, generate from, share, rename, and delete notebook content. Prefer an environment variable over the plaintext api-key file, review notebooks before sharing, and require your agent to ask for explicit confirmation before bulk imports, use-all-files generation, share-link creation, or any delete action.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (24)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill exposes powerful capabilities—environment access, file read/write, network, and shell execution—without an explicit permissions declaration. Even if intended for normal pipeline operation, this weakens reviewability and consent because users and the agent framework cannot clearly bound what the skill may do.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence
• Finding: The skill description emphasizes knowledge-base assistance, but the documented behavior includes destructive and higher-risk operations such as deleting knowledge bases/files, editing metadata, stopping searches, and deleting search history. This mismatch can cause users or calling agents to invoke the skill under a broader trust model than is warranted, increasing the chance of unintended destructive actions.

Vague Triggers

High

• Confidence: 94% confidence
• Finding: The activation criteria are extremely broad, including ordinary phrases like taking notes, remembering expenses, saving information, or sharing with colleagues, and the metadata sets the skill to always trigger. In practice this can route unrelated conversations into a tool with file, network, shell, and destructive knowledge-base capabilities, raising the risk of unintended external actions or data storage.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The eval case treating a vague prompt like “做好了吗” as a progress-query trigger can cause the skill to activate on ordinary conversation without clear user intent or task context. In a tool-enabled agent, this increases the chance of unintended status checks against prior jobs, which can leak workflow state or cause confusing, unsolicited actions.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: This test case requires forced file deletion without any user-facing warning or confirmation step. That is dangerous because an agent could delete user data from a knowledge base based on a short command, misrecognition, or prompt injection, with no safety interlock before an irreversible action.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The batch-delete case authorizes irreversible removal of multiple files with --force but does not require any warning, preview, or confirmation. Bulk deletion magnifies the blast radius of mistakes, making accidental or maliciously induced deletion substantially more harmful than a single-file operation.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The knowledge-base deletion flow uses a forced destructive action without requiring explicit warning or confirmation. Deleting an entire knowledge base can remove many documents and generated artifacts at once, so a mistaken match on “那个测试用的知识库” could cause significant permanent data loss.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The example instructs the agent to generate and return a read-only share link for an entire knowledge base without any verification step, scope confirmation, or warning that the recipient will gain access to all files and generated content in that notebook. In a knowledge-management skill, this can lead to inadvertent disclosure of sensitive internal documents, research notes, or personal data if the user shares the wrong collection or does not understand the breadth of exposure.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill instructs the agent to write user-pasted content into a temporary local markdown file and upload it, but it provides no safeguards around sensitive data handling, storage location hardening, retention limits, or user consent. In a knowledge-base workflow, pasted content may include meeting notes, personal data, credentials, or confidential business information, so creating plaintext temp files on disk increases exposure through local compromise, backup leakage, logs, or cleanup failure.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The workflow automatically imports a generated report plus many external papers/web pages into the knowledge base, which can create unintended data retention, storage bloat, copyright/compliance issues, and ingestion of untrusted content without explicit user confirmation at the point of action. In this skill context, the behavior is more dangerous because it is positioned as an automated multi-step pipeline, so a user asking for research may not realize that dozens of third-party items will be persistently stored.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The skill automatically launches a PDF creation task using the imported materials without an explicit consent or notice that a downstream generation job will consume those documents. This can trigger unwanted processing costs, produce misleading outputs from unreviewed sources, and surprise users who only intended research collection rather than content generation.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The example flow performs a side-effecting action—bulk importing 10 web results into a knowledge base and then launching report generation—as the default behavior after a search. This is dangerous because users may believe they are only searching or previewing results, while the system persists third-party content, which can create privacy, copyright, retention, and unwanted workspace-modification risks without explicit confirmation.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The trigger guidance is overly broad and includes generic user intents around everyday note-taking and saving information. In an agent setting, this can cause the skill to activate for routine conversations and send user content into an external knowledge-base workflow without sufficiently clear user intent, creating a risk of unintended data handling.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The URL-import workflow is described in a broad way that can match simple requests like saving or collecting a link, without requiring clear confirmation that the user wants the URL fetched and transmitted to the external iflow service. This increases the chance of accidental exfiltration of URLs that may contain sensitive query strings, private documents, or internal resources.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The text-import section instructs the agent to create a markdown file from user-provided text and upload it, using vague triggers such as 'help me note this down.' That ambiguity can cause ordinary conversational content, personal notes, or sensitive pasted text to be persisted and transmitted to the external knowledge base without sufficiently informed consent.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The share-link endpoint generates a transferable link to notebook contents, but the documentation does not describe access scope, expiration, revocation, or privacy expectations. In a skill explicitly designed for knowledge storage and sharing, this can lead users or integrators to expose sensitive notebook content unintentionally through long-lived or broadly accessible links.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documentation instructs agents to generate and return a share URL for a knowledge base, but it does not require any user confirmation, visibility warning, or sensitivity check before sharing. In this skill's context, knowledge bases may contain uploaded files, imported webpages, notes, and generated outputs, so silently creating a share link can expose potentially sensitive content to unintended parties.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The web-search pipeline documents automatic fetching of external content and importing it into the knowledge base, but it does not warn users that third-party content will be retrieved, persisted, and potentially used for later generation. In this skill, that behavior increases risk because user prompts may casually trigger storage of webpages, articles, or research results that contain copyrighted, sensitive, or unwanted material.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The trigger guidance is broad enough to activate on ordinary note-taking, saving links, daily records, and content-generation requests that may not clearly imply knowledge-base operations. That can cause the agent to route benign conversational requests into a skill that performs storage, retrieval, or generation over persisted user data, increasing the chance of unintended data handling and scope creep.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill specifies that if no files are provided, the system uses the entire knowledge base by default, but it does not require informing the user that all stored files will be included. This creates a real risk of over-collection and unintended use of unrelated or sensitive documents during report, PPT, podcast, or video generation.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: This workflow explicitly instructs the agent not to ask the user and to use all files in the knowledge base when the user does not specify files. In the context of a knowledge-base skill that supports sharing and content generation, that materially increases the chance that confidential, irrelevant, or cross-topic files are silently incorporated into outputs, potentially exposing sensitive information.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script creates a share link for a knowledge base and immediately logs and returns that link without any confirmation, access-scope check, or warning that the action may expose stored content to others. In this skill's context, the knowledge base may contain imported documents, notes, research, or potentially sensitive user data, so accidental sharing or leakage through logs can materially expose private information.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly says search results are imported into the knowledge base by default, but it does not require a clear user confirmation or warning before persisting externally sourced content. This creates a real privacy and data-governance risk because users may intend a transient search while the system stores URLs, documents, or generated artifacts in a persistent repository.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
# 方式 A — 配置文件（推荐，Linux/Mac）
mkdir -p ~/.config/happy-notes && echo "your_api_key" > ~/.config/happy-notes/api-key

# 方式 B — 环境变量
export IFLOW_API_KEY="your_api_key"

• Confidence: 87% confidence
• Finding: The setup recommends persisting the API key in a plaintext file under the user's home directory. Local plaintext secret storage increases the blast radius of compromise from other local processes, backups, shared accounts, or accidental disclosure, especially for a skill that also uses shell and file capabilities.

Static analysis

No suspicious patterns detected.