Security audit

IMA OpenAPI

Security checks for vulnerabilities and agentic risk

Overview

This IMA notes and knowledge-base skill is purpose-related, but it needs Review because it handles private notes, files, and credentials with under-scoped network and update behavior.

Install only if you are comfortable giving this skill access to your IMA notes, knowledge bases, selected local files, and IMA API credentials. Before use, avoid plaintext credential files when possible, do not set IMA_BASE_URL unless you fully trust the endpoint, treat update instructions as untrusted text, and be careful with URL imports because the workflow can fetch and upload remote content.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (5)

T01 · Skill Instruction Hijacking

Error

Location: ima_api.cjs:119
Finding: Backend-Controlled Update Instructions Can Hijack Agent Behavior
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: ima_api.cjs:65
Finding: IMA Credentials Can Be Transmitted to an Arbitrary Configurable Endpoint
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: knowledge-base/SKILL.md:193
Finding: Unrestricted URL Fetching Enables Server-Side Request Forgery
Content: View full analysis
" | grep -i "^content-type:" | tail -1 | awk '{print $2}' | tr -d '\r') # 2. 下载到临时目录 TEMP_DIR=$(mktemp -d) curl -sL -o "$TEMP_DIR/paper.pdf" "" # 3. preflight-check.cjs ← ⛔ GATE 1 PREFLIGHT=$(node .claude/skills/ima-skill/knowledge-base/scripts/preflight-check.cjs \ --file "$TEMP_DIR/paper.pdf" --content-type "$CONTENT_TYPE") # pass=false → terminate # 4. Follow "上传文件到知识库" workflow (Steps 3-7 with all gates) # 5. Clean up rm -rf "$TEMP_DIR" ``` ### Technical Analysis The workflow directs the Agent to perform both a header request and a full download from a user-provided URL. The `-L` option follows redirects, but the workflow performs no validation of: - URL scheme - Destination hostname - Resolved IP address - Redirect targets - Loopback, private, link-local, or multicast networks - Cloud instance metadata endpoints - Response size before download The downloaded response is then fed into the knowledge-base upload process. This creates both an SSRF primitive and a potential path for transferring internally accessible content to IMA/COS. The ability to access arbitrary network locations exceeds the minimum privilege required to import public web pages or public documents. ### Attack Path 1. An attacker provides a URL resolving to an internal service, loopback address, cloud metadata endpoint, or an external redirector that ultimately targets such a destination. 2. The Agent executes `curl -sI -L`, causing an initial internal request. 3. The Agent executes `curl -sL`, downloading the protected response into a temporary file. 4. If the response passes the extension or content-type checks, the documented workflow uploads it to Tencent COS and registers it in the user's IMA knowledge base. ...[truncated 604 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: knowledge-base/scripts/cos-upload.cjs:73
Finding: Long-Lived and Temporary Credentials Are Exposed Through Process Arguments
Content: View full analysis
/tmp/ima_err); then ``` The COS workflow similarly places temporary credentials in command-line options: ```bash node .claude/skills/ima-skill/knowledge-base/scripts/cos-upload.cjs \ --file "/path/to/report.pdf" \ --secret-id "" \ --secret-key "" \ --token "" \ --bucket "" \ --region "" \ --cos-key "" \ --content-type "$CONTENT_TYPE" \ --start-time "" \ --expired-time "" \ --timeout 300000 ``` The upload script reads these values directly from `process.argv`: ```js const REQUIRED = ['file', 'secret-id', 'secret-key', 'token', 'bucket', 'region', 'cos-key']; ``` ```js function upload(args) { const secretId = args['secret-id']; const secretKey = args['secret-key']; const { token } = args; const { bucket } = args; const { region } = args; const cosKey = args['cos-key']; ``` ### Technical Analysis Command-line arguments are not an appropriate secret-transport channel. Depending on operating-system configuration and execution infrastructure, process arguments may be visible through process inspection tools, `/proc`, diagnostic snapshots, command telemetry, job logs, or shell history. The IMA options argument conta ...[truncated 1070 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: knowledge-base/SKILL.md:78
Finding: Unescaped File Metadata Is Interpolated into JSON Request Bodies
Content: View full analysis
\" }" # ── Step 4: create_media ── CREATE_MEDIA_RESP=$(ima_api "openapi/wiki/v1/create_media" "{ \"file_name\": \"$FILE_NAME\", \"file_size\": $FILE_SIZE, \"content_type\": \"$CONTENT_TYPE\", \"knowledge_base_id\": \"\", \"file_ext\": \"$FILE_EXT\" }") ``` The same unsafe interpolation is repeated in the final request: ```bash ima_api "openapi/wiki/v1/add_knowledge" "{ \"media_type\": $MEDIA_TYPE, \"media_id\": \"\", \"title\": \"$FILE_NAME\", \"knowledge_base_id\": \"\", \"file_info\": { \"cos_key\": \"\", \"file_size\": $FILE_SIZE, \"file_name\": \"$FILE_NAME\" } }" ``` ### Technical Analysis `preflight-check.cjs` returns a filename derived from the local filesystem. The workflow extracts that filename and embeds it directly inside quoted JSON strings. It does no ...[truncated 1547 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (26)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The activation text is extremely broad and matches common phrases like '帮我记一下' or general document/search intents, which can cause the skill to trigger for routine conversation that the user did not intend to route to an external knowledge service. This increases the risk of accidental data disclosure, unintended persistence of personal content, or unnecessary use of stored credentials.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill declares network and environment-variable capabilities but does not explicitly constrain tool scope with a permissions/allowed-tools policy. In practice, this leaves the agent with ambiguous authority boundaries for credential access and outbound requests, increasing the chance of unintended tool use or abuse if the skill is invoked in the wrong context.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.
md
1. **UTF-8 encoding (notes writes only):** Before calling `import_doc` or `append_doc`, ALL string fields (`content`, `title`) MUST be validated as legal UTF-8. Non-UTF-8 content causes irreversible garbled text. See [Detailed Rules](#detailed-utf-8-encoding-rules) for platform-specific methods. 2. **File upload naming:** `title` MUST equal `file_name` (with extension). Never rename, shorten, translate, or modify the original filename. 3. **Unsupported file types:** Reject immediately with a clear message. Do NOT ask user "do you still want to try?" Video files, Bilibili/YouTube URLs, and `file://` URLs are not supported — tell user to use IMA desktop client. 4. **File upload integrity:** Keep file content as-is during upload. No encoding conversion for binary files (PDF, images, Excel, etc.). 5. **PowerShell 5.1 (all modules):** If running in PowerShell, detect version before first API call. PS 5.1 silently converts request Body to GBK — must use UTF-8 byte array mode. See [Detailed Rules](#powershell-51-environment-detection).

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The operational instructions and user-facing routing examples are written entirely in Chinese and implicitly assume Chinese-language interaction patterns, without offering a language or locale choice. Under the policy, skills should not force a specific language unless the constraint is documented and justified or the user opts in.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.
md
## 模块决策表 | 用户意图 | 模块 | 读取 | | ------------------------------------------------------------------------------------------ | -------------- | ------------------------- | | 搜索笔记、浏览笔记本、获取笔记内容、创建笔记、追加内容 | notes | `notes/SKILL.md` | | 上传文件、添加网页链接、搜索知识库、浏览知识库内容、获取知识库信息、获取可添加的知识库列表 | knowledge-base | `knowledge-base/SKILL.md` |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · notes/references/api.md (reported line 66)May include surrounding context.
md
## 模块决策表 | 用户意图 | 模块 | 读取 | | ------------------------------------------------------------------------------------------ | -------------- | ------------------------- | | 搜索笔记、浏览笔记本、获取笔记内容、创建笔记、追加内容 | notes | `notes/SKILL.md` | | 上传文件、添加网页链接、搜索知识库、浏览知识库内容、获取知识库信息、获取可添加的知识库列表 | knowledge-base | `knowledge-base/SKILL.md` |

Session Persistence

Medium

Category: Rogue Agent
Confidence: 91% confidence
Finding: The skill recommends persisting API credentials in plaintext files under ~/.config/ima, which creates a local secret-at-rest exposure risk. Other local users, processes, backups, shell history, or malware could recover these long-lived credentials and use them to access the user's IMA account or data.
Content: Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.
方式 A — 配置文件（推荐）：

bash
mkdir -p ~/.config/ima echo "your_client_id" > ~/.config/ima/client_id echo "your_api_key" > ~/.config/ima/api_key

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script emits user-facing error text in Chinese, and similar hard-coded Chinese messages appear elsewhere in the file. There is no opt-in, language selection mechanism, or documented justification for restricting output to a specific locale.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The code sends client ID and API key in outbound requests and this file provides no user-facing disclosure that credential-bearing calls will occur. In a skill context, undisclosed authenticated network activity is risky because users may trigger actions without understanding that secrets and request metadata are being transmitted to a remote service.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill performs a remote self-update check on most API calls, which is outside the stated note/knowledge functionality and creates an undeclared secondary network flow. Although it does not auto-download code, it transmits metadata and can alter runtime behavior by causing the tool to fail with an update-required condition, increasing privacy and integrity risk beyond user expectations.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · knowledge-base/SKILL.md (reported line 7)May include surrounding context.
md
## 接口决策表 | 用户意图 | 调用接口 | 关键参数 | | --------------------------------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------- | | 上传文件到知识库 | `check_repeated_names` → `create_media` → COS Upload → `add_knowledge` | `media_type`（按扩展名），`knowledge_base_id`，`file_name`，`file_size` | | 上传文件到知识库的某个文件夹 | 先定位文件夹 → 同上（`folder_id` 传入目标文件夹 ID） | 见「文件夹操作」章节 |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · knowledge-base/references/api.md (reported line 154)May include surrounding context.
md
## 接口决策表 | 用户意图 | 调用接口 | 关键参数 | | --------------------------------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------- | | 上传文件到知识库 | `check_repeated_names` → `create_media` → COS Upload → `add_knowledge` | `media_type`（按扩展名），`knowledge_base_id`，`file_name`，`file_size` | | 上传文件到知识库的某个文件夹 | 先定位文件夹 → 同上（`folder_id` 传入目标文件夹 ID） | 见「文件夹操作」章节 |

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest frames this skill as a unified IMA OpenAPI capability for note management and knowledge-base operations. In contrast, the documented workflow explicitly performs outbound network access to arbitrary user-supplied URLs via curl, including header inspection and full file download, which is a distinct web-fetching capability not inherent to basic knowledge-base CRUD/search behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The document instructs callers to send credential-bearing headers (ima-openapi-clientid, ima-openapi-apikey) and later also documents temporary COS secrets, but it provides no warning about treating these values as sensitive, redacting them from logs, or avoiding exposure in user-visible output. In an agent skill context, this omission is risky because LLM-driven tooling may echo headers, include them in traces, or mishandle them during debugging, which can lead to unauthorized API access.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The API reference defines URLInfo.headers as request headers required to access protected media URLs, but it does not warn that these headers may contain bearer tokens or other sensitive authorization material. In this skill, that is dangerous because an agent could retrieve protected content and accidentally disclose the signed URL or headers in messages, logs, or downstream requests, enabling unauthorized access to private documents.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · knowledge-base/references/api.md (reported line 156)May include surrounding context.
md
| 值 | 名称 | content_type / 说明 | | --- | -------------- | ------------------------------------------------------------------------------------------------------------- | | 1 | PDF | `application/pdf` | | 2 | 网页 | N/A（直接 AddKnowledge，`web_info.content_id=<url>`） | | 3 | Word | `application/msword` / `application/vnd.openxmlformats-officedocument.wordprocessingml.document` | | 4 | PPT | `application/vnd.ms-powerpoint` / `application/vnd.openxmlformats-officedocument.presentationml.presentation` |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · knowledge-base/references/api.md (reported line 166)May include surrounding context.
md
| 9 | 图片 | `image/png`, `image/jpeg`, `image/webp` | | 11 | 笔记 | N/A（直接 AddKnowledge，`note_info.content_id=<doc_id>`） | | 12 | AI会话 | N/A（直接 AddKnowledge，`session_info.content_id=<session_id>`） | | 13 | TXT | `text/plain` | | 14 | Xmind | `application/x-xmind` / `application/vnd.xmind.workbook` / `application/zip` | | 15 | 录音 | `audio/mpeg`(mp3), `audio/x-m4a`(m4a), `audio/wav`(wav), `audio/aac`(aac) | | 16 | 视频解析 | **不支持通过 skill 添加**。Bilibili/YouTube/本地HTML等仅支持在 ima 桌面端内添加进知识库 |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · knowledge-base/references/api.md (reported line 467)May include surrounding context.
md
#### 返回字段（`data` 内） | 字段 | 类型 | 说明 | | ------------------- | --------------- | ------------------------------------------------------------------------------------------------- | | `media_type` | int32 | 媒体类型（见 MediaType 枚举） | | `url_info` | URLInfo | 访问链接信息，非笔记类型时填写（见 [URLInfo](#urlinfo访问链接信息)） |

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This code requires sensitive credential arguments (--secret-id, --secret-key, --token) and later performs an HTTPS PUT upload of local file contents to COS, but the user-facing messaging only covers usage and errors. There is no confirmation prompt or explicit warning that the script will transmit local file data and credential-derived authorization material to a remote service.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger guidance for SearchNote uses broad phrases like “搜索”“找笔记”“查找包含XX的内容” without requiring stronger note-specific context or user confirmation. In a skill that can access private notes, overly generic triggers increase the chance of accidental invocation and unintended retrieval of sensitive user data.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Phrases such as “列出笔记” and especially “最近的笔记” are underspecified and can match common conversational requests that do not clearly authorize private note enumeration. Because the skill operates on personal note metadata, accidental activation could expose notebook structure, titles, and timestamps.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The write-capable ImportNote trigger includes very broad phrases like “新建笔记”“导入笔记”“把这段内容保存为笔记” without clearly defined boundaries or confirmation requirements. Overbroad activation on a write operation is more dangerous than read-only misfires because it can create or store content in a user's private workspace without clear intent.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: The skill's stated purpose is operating on notes and knowledge bases, but the implementation also reads credentials from environment variables and from ~/.config/ima/, and persists update-check state under the user's home directory. While credentials may be a practical integration detail, local filesystem access for credential and updater state management is not justified by the manifest's functional description and is not disclosed there.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The workflow explicitly performs curl HEAD/GET requests and stores remote content in a temporary directory, but it does not require a user-facing notice that the provided URL will be fetched by the backend and that remote content will be transmitted through system infrastructure. This can create privacy and security issues, especially if users supply internal, sensitive, or authenticated URLs, because the agent may initiate unintended network access and retrieve potentially sensitive content.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: SQP-3 适用于所有文件。该文档整体以中文定义技能名称、用户意图和触发场景，但没有说明这是面向中文用户的特定区域技能，也没有提供用户语言选择或多语言兼容说明，存在默认强制单一语言/locale 的自然语言策略风险。
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access, suspicious.exposed_secret_literal

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: ima_api.cjs:31

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: knowledge-base/scripts/cos-upload.cjs:96