Deepvista Recipe Analyze Notes

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:31 AM UTC
• Version: 0.1.0-alpha.21

Overview

The skill mostly matches its note-analysis purpose, but it can retrieve private notes and suggests sending note contents to a chat service without an explicit consent or redaction step.

Review this skill carefully before installing if your DeepVista notes may contain personal, business, credential, or confidential information. Use the read/search analysis workflow only for notes you intend the agent to inspect, avoid `chat +send` with raw note contents unless you explicitly approve the payload and understand where it goes, and prefer redacted or minimal excerpts. Pinning the DeepVista CLI version would also make installation more predictable.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:15

Finding

Unpinned Third-Party CLI Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 15-19
Vulnerability Type: Supply-chain risk from an unpinned external dependency
Risk Level: Medium

Vulnerable Code

yaml

install:
  - kind: uv
    package: deepvista-cli
    bins: [deepvista]

Technical Analysis

The skill directs the environment to install deepvista-cli without specifying an exact version or an integrity hash. Consequently, the installed package can change independently of the reviewed skill. The package implementation is not included in the project, so its runtime behavior cannot be assessed from this repository.

Installing a mutable package version creates a supply-chain exposure: a compromised publisher account, malicious future release, dependency confusion event, or compromised package index could cause attacker-controlled code to be installed and executed. This finding does not establish that the current package is malicious; it identifies the absence of controls needed to ensure that the installed artifact is the version that was reviewed.

Attack Path

1. An attacker compromises the package publisher, package repository, distribution channel, or a transitive dependency.
2. The attacker publishes a malicious release under the expected package name.
3. The skill installation process resolves deepvista-cli without an exact version or integrity constraint.
4. The malicious package is downloaded and installed.
5. Package installation hooks or subsequent deepvista invocations execute attacker-controlled code in the agent environment.

Impact Assessment

Exploited package code would run with the privileges of the process installing or invoking the CLI. Depending on those privileges, it could access DeepVista authentication material, read or modify files available to the agent, exfiltrate note contents, alter command results, or execute arbitrary local commands. No privilege escalation beyond the invoki ...[truncated 48 chars]

Remediation

View remediation

Remediation Suggestions

• Pin deepvista-cli to an exact, audited version rather than resolving the latest available release.
• Verify the downloaded artifact using a trusted cryptographic hash or package signature.
• Use a trusted package index and explicitly document the expected publisher and source repository.
• Review direct and transitive dependencies before updating the pinned version.
• Perform dependency updates through a controlled review process with automated vulnerability and provenance checks.
• Run the CLI with least privilege and restrict its filesystem and network access where practical.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:37

Finding

Shell Command Injection Through Unsafe Dynamic Argument Interpolation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 37-59
Vulnerability Type: Shell command injection
Risk Level: High

Vulnerable Code

bash

deepvista card +search "<topic or keyword>" --type note --limit 20

bash

deepvista notes get <note_id>

bash

deepvista notes create --title "Analysis: <topic> — <date>" --content "<synthesis>"

Technical Analysis

The documented commands place user-derived topics, retrieved note identifiers, and generated synthesis content directly into shell command templates. Quoting a value with double quotes does not safely neutralize all shell syntax: embedded double quotes can terminate the intended argument, while command substitutions such as $() and backticks can still be evaluated inside double quotes. The unquoted <note_id> placeholder is additionally exposed to whitespace splitting, option injection, redirection, pipelines, and command separators.

Generated synthesis content may also contain attacker-controlled text originating from retrieved notes. If an agent implements these examples by constructing a command string and passing it to a shell, malicious user input or note content could escape the intended CLI argument and execute an unintended operating-system command.

The issue depends on shell-based textual substitution. It is not exploitable if the runtime invokes the executable directly with a correctly separated argument array and no shell.

Attack Path

1. An attacker supplies a crafted analysis topic or causes a retrieved note, note identifier, or synthesis to contain shell metacharacters or command-substitution syntax.
2. The agent substitutes that value into one of the documented command strings.
3. The completed string is passed to a shell rather than to a direct process-execution API.
4. The shell interprets the injected syntax as executable commands, substitutions, redirections, ...[truncated 893 chars]

Remediation

View remediation

Remediation Suggestions

• Never construct these commands through shell string concatenation or textual placeholder replacement.
• Invoke deepvista through a process-execution API that accepts an executable and a separate argument array.
• Treat the topic, note ID, title, date, and synthesis as opaque argument values.
• Validate note IDs against the strictest format supported by DeepVista, such as an anchored allowlist for expected prefixes and alphanumeric characters.
• Reject unexpected control characters and enforce reasonable length limits on all externally influenced fields.
• Use a file or standard input for long note content if the CLI securely supports it, rather than embedding content in a command string.
• If a shell is unavoidable, apply robust platform-specific escaping to every dynamic argument and prohibit shell expansions; ad hoc quote replacement is insufficient.
• Add tests using embedded quotes, semicolons, newlines, backticks, $() expressions, leading hyphens, and redirection characters.

other

Warning

• Location: SKILL.md:66

Finding

Potential Unauthorized Disclosure of Private Notes to an External AI Service

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 66-69
Vulnerability Type: Sensitive-data disclosure to an external service
Risk Level: Medium

Vulnerable Code

bash

deepvista chat +send "Here are my recent notes: <paste content>. What are the key themes?"

Technical Analysis

The skill recommends pasting recent note contents into deepvista chat +send for synthesis. Notes may contain personal information, confidential business data, credentials, or other sensitive material. Unlike the later note-creation operation, this remote processing suggestion is not conditioned on explicit user confirmation, redaction, or data minimization.

The repository does not document the exact destination, transport configuration, data-retention policy, training policy, or access controls associated with chat +send. Therefore, the audit cannot establish misuse by the service, but it can establish that the instruction creates a path for note contents to leave the immediate local analysis context without an explicit consent requirement.

Attack Path

1. The skill searches for and retrieves full note contents from the user's knowledge base.
2. Retrieved notes contain confidential or personally sensitive information.
3. The agent follows the optional recommendation and includes the contents in a deepvista chat +send request.
4. The CLI transmits the supplied contents to its configured remote processing service.
5. The external service receives and may process or retain information that the user did not explicitly approve for external disclosure.

An attacker who can place content in a note could also attempt to induce broader disclosure by embedding instructions that encourage the agent to include unrelated notes or secrets in the remote request. The reviewed file does not itself instruct the agent to follow such embedded content, but minimizing submitted data remains necessary.

Impact Assessmen

...[truncated 400 chars]

Remediation

View remediation

Remediation Suggestions

• Require explicit, informed user consent before sending any note contents to an external AI or chat service.
• Clearly identify the recipient service and summarize its retention, access, and model-training policies before transmission.
• Default to local synthesis where possible.
• Minimize the submitted data to only the excerpts required for the requested analysis.
• Detect and redact credentials, API keys, personal identifiers, financial data, and other sensitive information before transmission.
• Present the exact proposed payload or a clear summary of its scope to the user for approval.
• Avoid sending unrelated notes and impose a strict maximum number and size of excerpts.
• Document transport-security requirements and provide a mechanism to opt out of remote processing.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The phrase "or any request to make sense of multiple notes at once" is open-ended and can overlap with many common note-related requests beyond the intended scope. Although some concrete examples and exclusions are provided, this catch-all clause still makes activation boundaries ambiguous.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The frontmatter explicitly says the skill should not trigger for create/update/delete note requests and should defer to deepvista-notes. Later, the instructions tell the agent it may save the analysis by creating a new note, which conflicts with that stated boundary even if confirmation is required.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest description and trigger guidance position this as an analysis recipe for searching, retrieving, and synthesizing notes. However, the documented steps explicitly include deepvista notes create, which performs a write operation and goes beyond a purely analytical/read-oriented skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill recommends pasting note contents into another AI agent for synthesis without any warning, consent flow, or data-minimization guidance. This can expose sensitive knowledge-base contents to a separate model or service boundary, creating a real confidentiality and compliance risk, especially because notes often contain personal, business, or proprietary information.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.