Sync Notes

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:21 AM UTC
• Version: 1.0.1

Overview

The skill's notes-sync purpose is clear, but it needs review because its shell configuration handling can turn crafted setup/config values into commands during sync.

Review before installing. This skill can change or delete notes on both local and remote storage and stores R2/rclone secrets locally. The main issue to fix is replacing sourced .env shell config with safely parsed data, validating setup inputs, and removing or allowlisting extra rclone flags. Use status and dry-run first, and keep an independent backup of the vault.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/setup.sh:100

Finding

Arbitrary Command Execution and rclone Option Injection Through Unsafe Configuration Handling

Content

View full analysis

"$ENV_FILE" <

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (20)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 31)May include surrounding context.

md

#!/usr/bin/env bash
# Interactive configuration wizard for the sync-notes skill.
# Writes config/rclone.conf and config/.env (chmod 600).

set -euo pipefail

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 62)May include surrounding context.

md

#!/usr/bin/env bash
# Interactive configuration wizard for the sync-notes skill.
# Writes config/rclone.conf and config/.env (chmod 600).

set -euo pipefail

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.zh-CN.md (reported line 31)May include surrounding context.

md

#!/usr/bin/env bash
# Interactive configuration wizard for the sync-notes skill.
# Writes config/rclone.conf and config/.env (chmod 600).

set -euo pipefail

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.

md

#!/usr/bin/env bash
# Interactive configuration wizard for the sync-notes skill.
# Writes config/rclone.conf and config/.env (chmod 600).

set -euo pipefail

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup.sh (reported line 3)May include surrounding context.

sh

#!/usr/bin/env bash
# Interactive configuration wizard for the sync-notes skill.
# Writes config/rclone.conf and config/.env (chmod 600).

set -euo pipefail

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup.sh (reported line 11)May include surrounding context.

sh

SKILL_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
CONFIG_DIR="$SKILL_DIR/config"
RCLONE_CONFIG_FILE="$CONFIG_DIR/rclone.conf"
ENV_FILE="$CONFIG_DIR/.env"

command -v rclone >/dev/null 2>&1 || { echo "rclone is required" >&2; exit 1; }

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/sync.sh (reported line 23)May include surrounding context.

sh

SKILL_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
CONFIG_DIR="$SKILL_DIR/config"
RCLONE_CONFIG_FILE="$CONFIG_DIR/rclone.conf"
ENV_FILE="$CONFIG_DIR/.env"

command -v rclone >/dev/null 2>&1 || { echo "rclone is required" >&2; exit 1; }

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/sync.sh (reported line 93)May include surrounding context.

sh

clean_failed_baseline() {
  # Wipe partial bisync state so --resync can start clean.
  rm -f "$BISYNC_WORKDIR"/*.lst-new "$BISYNC_WORKDIR"/*.lst-err 2>/dev/null || true
}

scan_conflicts() {

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill explicitly orchestrates shell execution via bash/rclone but declares no tool scope restrictions such as allowed tools or permissions. In an agent environment, this broadens the execution surface and can allow unintended shell access or make policy enforcement ambiguous, especially for a skill that performs filesystem and remote sync operations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The user-facing description does not prominently warn that bidirectional sync and copy operations can overwrite files or propagate deletions/conflicts between local and remote storage. This creates a real safety risk of unintended data loss because users may trigger destructive synchronization without informed consent.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 29)May include surrounding context.

md

#!/usr/bin/env bash
# Interactive configuration wizard for the sync-notes skill.
# Writes config/rclone.conf and config/.env (chmod 600).

set -euo pipefail

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 31)May include surrounding context.

md

#!/usr/bin/env bash
# Interactive configuration wizard for the sync-notes skill.
# Writes config/rclone.conf and config/.env (chmod 600).

set -euo pipefail

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 62)May include surrounding context.

md

#!/usr/bin/env bash
# Interactive configuration wizard for the sync-notes skill.
# Writes config/rclone.conf and config/.env (chmod 600).

set -euo pipefail

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.zh-CN.md (reported line 29)May include surrounding context.

md

#!/usr/bin/env bash
# Interactive configuration wizard for the sync-notes skill.
# Writes config/rclone.conf and config/.env (chmod 600).

set -euo pipefail

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.zh-CN.md (reported line 31)May include surrounding context.

md

#!/usr/bin/env bash
# Interactive configuration wizard for the sync-notes skill.
# Writes config/rclone.conf and config/.env (chmod 600).

set -euo pipefail

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 146)May include surrounding context.

md

#!/usr/bin/env bash
# Interactive configuration wizard for the sync-notes skill.
# Writes config/rclone.conf and config/.env (chmod 600).

set -euo pipefail

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/setup.sh (reported line 3)May include surrounding context.

sh

#!/usr/bin/env bash
# Interactive configuration wizard for the sync-notes skill.
# Writes config/rclone.conf and config/.env (chmod 600).

set -euo pipefail

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/setup.sh (reported line 95)May include surrounding context.

sh

#!/usr/bin/env bash
# Interactive configuration wizard for the sync-notes skill.
# Writes config/rclone.conf and config/.env (chmod 600).

set -euo pipefail

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/setup.sh (reported line 102)May include surrounding context.

sh

#!/usr/bin/env bash
# Interactive configuration wizard for the sync-notes skill.
# Writes config/rclone.conf and config/.env (chmod 600).

set -euo pipefail

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The trigger examples and parsing rules embed Chinese-specific commands such as 下载, 拉, 上传, and 试, which indicates locale-specific behavior. The file does not explicitly state that multiple languages are supported by choice or that Chinese parsing is optional, so it risks imposing undocumented language handling policy.

Content

No source excerpt is available for this finding.