Security audit

Notes (Local, Apple, Notion, Obsidian & more)

Security checks across malware telemetry and agentic risk

Overview

This is a coherent notes skill, but it grants broad automatic authority to update and sometimes delete durable note, action, contact, and project records.

Install only if you want the agent to maintain a full notes system, not just save isolated notes. Keep routing local by default, explicitly approve any Notion or Evernote routing, and require previews for deletions, migrations, bulk edits, contact/project updates, and action sweeps. Do not let it store secrets; use pointer-only credential handling as the skill describes.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (32)

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: This file expands a note-capture skill into an autonomous task-management and social follow-up system, including escalating overdue items, deleting records, updating contacts, and performing weekly review actions across multiple files. That creates a scope-creep vulnerability: routine note-taking conversations can trigger persistent state changes and behavioral nudges the user did not explicitly request, causing integrity, privacy, and trust issues in personal knowledge data.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The skill includes a destructive `clinote note delete --title "..."` operation even though the Notes skill is primarily framed around capturing and retrieving notes. Because Evernote notes are addressed by title rather than stable IDs, the file itself acknowledges that duplicate or near-duplicate titles make delete operations ambiguous, which creates a real risk of accidental data loss if an agent invokes deletion. In this skill context, destructive note management is more dangerous because the integration is remote and affects durable user content outside the local workspace.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The instruction at line 178 tells the agent to perform multiple side-effecting writes across unrelated stores in the same turn: the meeting note, actions, decisions, contacts, project summaries, recurring meetings, and open threads. That expands a simple note-taking action into broad state mutation, increasing the chance of overreach, accidental data corruption, and writes of sensitive meeting content into places the user did not explicitly ask to modify.

Context-Inappropriate Capability

Medium

Confidence: 84% confidence
Finding: Directing the agent to update a shared contacts database from meeting processing is broader than necessary for capturing notes and may cause personal data to be added or changed without a clear user request. In meeting contexts, attendees and absentees can include sensitive relationship, employment, or client information, so automatic propagation into a shared contacts store raises privacy and data-minimization concerns.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The instruction at line 136 expands this skill from note capture/retrieval into writing to unrelated durable stores such as actions and shared contacts files. That creates a cross-scope side effect where a research-note invocation can silently create or modify task and contact records, increasing the chance of unintended persistence, misrouting of personal data, or unauthorized changes in other workflows.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The skill advertises very broad trigger phrases such as 'write this up' and 'capture this', which can match many normal conversations and cause the notes skill to activate unexpectedly. In a persistence-oriented skill that reads and writes local files and may route content to external note platforms, overbroad invocation increases the chance of unintended capture, storage, or transmission of sensitive user content.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The write-trigger language at line 101 instructs the agent to perform several file writes 'in the same turn' for every extracted commitment, plus related updates to contacts, memory, and review files. Because note-taking requests are common and often ambiguous, this broad trigger can cause unintended invocation and cascading writes from ordinary conversation, increasing the risk of accidental data modification, over-collection, and cross-file corruption.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill directs the agent to write derived data to several local files (`memory.md`, `config.yaml`, `actions.md`, and `## Note Map`) as part of the same turn, without requiring explicit user confirmation or clearly warning that these side effects will occur. This creates a state-integrity risk: sensitive content or action items from Apple Notes can be propagated into multiple files unexpectedly, increasing data exposure, persistence, and the chance of unauthorized or unintended configuration changes.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The file defines broad automatic 'write triggers' that cause writes to several separate local files in the same turn, based on note activity rather than a narrowly scoped, explicitly confirmed user request. This can lead to unintended side effects, silent data propagation, and overcollection of information across the user's local note system, especially when action items or routing decisions are inferred from content.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill instructs the agent to write to multiple local files such as memory.md, config.yaml, Note Map, actions.md, and artifacts/tag-taxonomy.md, but it does not require a prominent user-facing warning or consent flow for these side effects. In practice, this creates a hidden multi-write behavior where a simple note operation can modify unrelated local state, increasing the risk of privacy leaks, data corruption, and surprising persistence.

Vague Triggers

High

Confidence: 95% confidence
Finding: The file defines broad write triggers such as 'in the same turn, no ceremony' and maps common note-taking situations to immediate filesystem writes and updates across multiple files. In an agent setting, this can cause the skill to activate on loosely related user input and perform unintended side effects, including creating, modifying, or deleting notes without a clear confirmation boundary.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: These instructions explicitly direct the agent to create files, append to shared indexes, and delete captures during triage, but they do not require a user-facing warning or confirmation before destructive or multi-file operations. This is dangerous because users may expect summarization or organization help, while the agent silently performs persistent changes, including deletions, that are hard to audit or reverse.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The instruction to 'write triggers for this file' expands one user action into a bundle of side effects across multiple files, including decisions, project notes, contacts, actions, and memory. Because the trigger scope and preconditions are not tightly bounded or explicitly user-confirmed, an agent could over-apply it and modify unrelated or sensitive records based on inferred context rather than clear authorization.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The instructions direct the agent to create or modify several files in the same turn without requiring a user warning or confirmation. In a note-taking skill, this is risky because users may expect a single decision record to be written, but the agent may also alter contacts, project records, action lists, and memory indices, causing unintended persistence, privacy exposure, or data integrity issues.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The 'Write triggers for this file — in the same turn' directive authorizes multiple side-effecting writes to several local files and artifacts whenever this skill is used, including updates to memory, config, note maps, actions, and migration artifacts. That breadth increases the chance of unintended persistence, over-collection, and cross-file modification beyond the user's immediate request, especially since the triggers are framed as automatic behavior rather than narrowly scoped, consented actions. In this skill context, the danger is elevated because the skill handles sensitive notes and routing metadata, so unnecessary writes can leak or entrench private information.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The final section instructs the agent to perform multiple write operations 'in the same turn' across several files, including appending review blocks, updating due rows, modifying actions, and creating conventions or artifacts. This broad, compound write trigger can cause unintended file modifications from loosely matched user requests, increasing the risk of overbroad persistence, accidental state corruption, or unauthorized note changes.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The phrase "Write triggers for this file — in the same turn" authorizes automatic writes to multiple local files based on broad conditions, which can cause unintended activation and side effects without an explicit per-action confirmation. In this skill context, the danger is higher because the target paths are real local note files under the user's home directory, so a mistaken trigger could silently alter corpus metadata, indexes, and memory state.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The broad 'write triggers for this file' language can cause the skill to interpret ordinary meeting-note requests as authorization for a large chain of downstream updates. That creates prompt-scope creep: a user asking to capture a note may unintentionally trigger modifications to several records and indexes, making mistakes harder to detect and undo.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The instructions authorize cross-file writes without requiring an explicit warning to the user that multiple records will be modified. In a note-taking skill, hidden secondary writes are dangerous because they violate user expectations, can replicate sensitive content into more locations, and make auditability and consent weaker.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The instruction 'No permission needed' combined with broad event-driven write rules allows the skill to persist user content and metadata automatically whenever it infers a note-related event occurred. In a notes skill, that creates a real risk of over-collection and unintended persistence of sensitive material without an explicit confirmation boundary for high-risk writes.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The line uses a broad imperative write trigger ('Write triggers for this file — in the same turn') that instructs the agent to perform multiple writes across notes, config, status, due tables, and actions files. In an agentic environment, this can cause unintended invocation and large-scale side effects from merely referencing or consulting the migration guidance, especially because the writes span the user's corpus and configuration rather than a single scoped artifact.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The instructions direct extensive updates to config.yaml, memory maps, platform facts, status counts, due tables, and actions.md, but do not prominently warn that this is a corpus-wide, potentially disruptive operation. Without an explicit caution and confirmation boundary, an agent may modify many durable files based on a migration discussion or partial context, increasing the risk of corruption, accidental rerouting, and hard-to-reverse state changes.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill contains explicit write-trigger instructions to modify several local state files (`memory.md`, `config.yaml`, `actions.md`, and a due table) in the same turn. That creates hidden side effects beyond the user’s immediate note action, which can unexpectedly alter configuration, task tracking, and persistent memory, especially because the skill description does not clearly foreground these automatic writes.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The final 'Write triggers' section instructs the agent to update several separate files automatically in the same turn, including memory, config, note maps, actions, and artifacts. That creates a broad cross-file write surface where a simple note operation can silently mutate unrelated state, propagate untrusted note content into tracking files, and cause unintended or hard-to-audit persistence.

Missing User Warnings

Medium

Confidence: 82% confidence
Finding: The operations guidance includes create, move, and delete commands against the user's vault, but it does not pair destructive actions with an explicit confirmation requirement or user-visible warning. In an agent setting, this increases the risk of accidental deletion, misrouting notes into the wrong vault, or overwriting organizational state based on ambiguous instructions or stale defaults.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: sensitive.md:52