智能办公本助手

• Outcome: Review
• Latest audit: Sep 1, 2026 · 7:12 AM UTC
• Version: 1.3.6

Overview

This skill is for Doxent notes, books, and schedules, but it can automatically install, update, run, and persist a local CLI while also changing real user data.

Review this skill before installing. It is not evidence of malicious intent, but it can make persistent local system changes, run and update a background CLI, synchronize Doxent data, upload files, and modify or delete real notes, schedules, reminders, todos, and tasks. Install only if you trust the Doxent CLI download source and are comfortable with automatic updates and persistent environment changes.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (17)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# 不传不存在的 background 参数，避免把旧版 Ainote 约定误传给 Doxent。
            # CLI 由 Skill 作为后台服务唤醒，不能继承 Codex/Agent 的控制台；登录页由 CLI
            # 自己打开浏览器，控制台窗口对用户没有价值，反而会造成误以为需要手工操作。
            subprocess.Popen(command, stdin=subprocess.DEVNULL, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, close_fds=True, creationflags=hidden_creation_flags(new_process_group=True), env=cli_environment(), shell=False)
            return True
        except (OSError, subprocess.SubprocessError):
            # 一个候选入口失败时继续尝试安装目录中的其他入口。

• Confidence: 88% confidence
• Finding: The code launches a local executable discovered from environment variables, config files, and filesystem locations, and may also auto-download and execute a new binary. Although shell=False avoids classic shell injection, executing an untrusted or attacker-planted binary still yields arbitrary code execution in the user's context.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

default_url = "http://127.0.0.1:{}/open-model-note/health".format(configured_port())
                executable, _ = ensure_cli_current(executable, service_is_running=service_ready(default_url))
            command = cli_command(executable, [argument])
            result = subprocess.run(
                command,
                shell=False,
                stdin=subprocess.DEVNULL,

• Confidence: 88% confidence
• Finding: This call executes a CLI path assembled from prior discovery logic that trusts environment-controlled and config-derived paths. If an attacker can influence DOXENT_CLI_PATH, launch metadata, or installation location, this becomes arbitrary local code execution with the current user's privileges.

Tainted flow: 'command' from os.environ.get (line 744, credential/environment) → subprocess.Popen (code execution)

Medium

• Category: Data Flow

Content

# 不传不存在的 background 参数，避免把旧版 Ainote 约定误传给 Doxent。
            # CLI 由 Skill 作为后台服务唤醒，不能继承 Codex/Agent 的控制台；登录页由 CLI
            # 自己打开浏览器，控制台窗口对用户没有价值，反而会造成误以为需要手工操作。
            subprocess.Popen(command, stdin=subprocess.DEVNULL, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, close_fds=True, creationflags=hidden_creation_flags(new_process_group=True), env=cli_environment(), shell=False)
            return True
        except (OSError, subprocess.SubprocessError):
            # 一个候选入口失败时继续尝试安装目录中的其他入口。

• Confidence: 93% confidence
• Finding: The executed command can be influenced by environment variables such as DOXENT_CLI_PATH and DOXENT_NODE, and launch discovery also reads config files from user-writable locations. In a skill that auto-starts background software, this materially increases the chance of attacker-controlled code execution if local environment or config state is poisoned.

Tainted flow: 'command' from os.environ.get (line 744, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow

Content

default_url = "http://127.0.0.1:{}/open-model-note/health".format(configured_port())
                executable, _ = ensure_cli_current(executable, service_is_running=service_ready(default_url))
            command = cli_command(executable, [argument])
            result = subprocess.run(
                command,
                shell=False,
                stdin=subprocess.DEVNULL,

• Confidence: 93% confidence
• Finding: This subprocess.run path is similarly tainted by environment/config-based executable discovery, allowing execution of a substituted binary or node runtime. Because the script can be triggered to perform lifecycle actions automatically, exploitation would give reliable arbitrary code execution in the user session.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill directs the agent to use shell execution, network access, environment variables, and file read/write behavior, but it does not declare any permissions to make those capabilities explicit. This creates a transparency and policy-enforcement gap: reviewers and runtime controls may underestimate the skill’s power, while the skill can still download binaries, modify user shell configuration, write executables, and make authenticated local API calls.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The documentation authorizes the skill to automatically download, install, replace, and restart a local CLI outside its core note/calendar data-access scope. That creates a software supply-chain and local-environment modification risk, especially because it persists binaries and may stop and replace an existing daemon based on remote metadata checks without an explicit per-action user confirmation.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The skill description authorizes a wide range of read, write, move, delete, import, and task-management actions based on broad natural-language triggers, which increases the chance of overbroad invocation or unintended destructive operations. In this context, the skill operates on real user data in Doxent, so ambiguous trigger boundaries can cause unauthorized access, modification, or deletion when the assistant infers the user wants persistence or account operations too aggressively.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The manifest instructs the agent to automatically connect or update a local CLI and wait for sync without any user-facing consent step or warning, which can trigger software changes and local system interactions beyond the user’s immediate data request. Because this skill targets real notes, books, schedules, and tasks, silent CLI installation, update, login, or synchronization could alter the host environment and expose or modify sensitive local data unexpectedly.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The skill enables uploading local files and fetching remote URLs but does not require an explicit user warning or confirmation about privacy, data transfer, and trust of remote sources. In an agent setting, this can lead to accidental exfiltration of sensitive local content or unintended retrieval of attacker-controlled remote content under the guise of normal book import behavior.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The upload API description explicitly states that it may copy local files, download remote URLs, and then upload the content to the cloud, but it does not require an explicit user-facing warning or confirmation before doing so. In a skill that operates on real Doxent user data, this increases the risk of unintended exfiltration of local files or silent cloud transfer of remotely sourced content when a user may think they are only importing locally.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The skill explicitly supports deleting notes and folders, but the description does not warn about irreversible data loss or require explicit user confirmation in user-facing behavior. In a real-data note system, destructive operations against user content raise the risk of accidental or unauthorized deletion, especially when the skill is invoked broadly for note operations.

Vague Triggers

High

• Confidence: 93% confidence
• Finding: The trigger rules are intentionally broad enough to capture natural-language scheduling requests even when users do not explicitly mention Doxent objects. In an agent-routing context, this can cause ordinary conversational text about plans or times to be misclassified as a command to create or modify real schedule data, leading to unintended writes, edits, or deletions in a user's account.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The workflow includes destructive operations such as delete, complete, move, and update, but the skill text does not consistently require user-facing warning or confirmation that real data will be changed. Even though it says to confirm the object before delete/complete/move, it does not broadly enforce explicit consent for all writes, so a misrouted or ambiguous request could silently alter user schedules or tasks.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The markdown describes modifying local executables, persisting PATH changes, and restarting the daemon without a clear upfront warning that the skill will alter the user's system. In an agent context this is dangerous because users may believe they are only accessing notes or schedules, while the skill silently performs privileged-looking persistence and binary replacement operations.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The script rewrites the user's shell profile to persist PATH and DOXENT_CLI_PATH changes without an explicit user-facing confirmation. In an agent skill context, silently modifying startup files is risky because it creates lasting system state changes and can normalize persistence behavior beyond the user's immediate request.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: Writing persistent environment variables to the user's Windows registry without notice creates lasting configuration changes outside the immediate action requested. In a skill that auto-installs and runs software, this persistence behavior is more dangerous because it survives the current session and affects future command resolution.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The script automatically downloads, writes, marks executable, and later runs a CLI binary on the user's machine without explicit warning or confirmation. Even though it performs some size/format/hash checks, this is a high-risk behavior for an agent skill because it crosses from data access into unattended software installation and execution.

Static analysis

No suspicious patterns detected.