T09 · Insecure Skill Coding Practices
Error
- Location
debug_createdoc.py:9- Finding
Hard-Coded SiYuan API Token Transmitted over Unencrypted HTTP
- Content
View full analysis
- Remediation
View remediation
Security audit
思源笔记增强版
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches its SiYuan note-taking purpose, but it ships live-looking credentials and can persist conversations or modify notes without enough safeguards.
Review before installing. Only use this with a SiYuan instance you control, rotate the exposed token if it was ever valid, prefer environment variables or a credential store over config-file tokens, restrict HTTP to localhost or use HTTPS, and require explicit approval plus redaction before syncing full conversations or running the included test/debug scripts.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
siyuan_note.py:130- Finding
Plaintext Token Persistence and Unrestricted Cleartext API Endpoint Configuration
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (93)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 91% confidence
- Finding
声明总体上提到“读取和写入笔记内容”，与代码对思源笔记 API 的读写交互有一定相关性；但该代码块的实际主要用途不是一个通用的读写技能，而是针对 createDocWithMd/createDoc/createDailyNote 的调试与测试脚本。它包含硬编码的内网地址与访问 Token，并会对特定实例执行实际创建操作和接口验证，这属于未在描述中体现的更具体且敏感的能力/行为。因此应判定为描述与行为存在实质性不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
声明整体方向与代码所属领域一致，都是围绕思源笔记进行交互，也确实包含读取和写入操作。但代码的实际用途与描述存在实质偏差：它不是一个通用“读写技能”，而是一个面向特定主机和令牌的测试脚本，用于实验不同 API 创建文档的方法并验证结果。代码还包含对固定内网地址和凭证的直接访问，这种针对特定资源的访问方式在声明中没有体现。虽然‘读取/写入笔记内容’本身没有错，但对该代码块而言，声明过于宽泛且遗漏了其真实主要行为——API创建方式测试与特定实例访问，因此应判定为描述与行为不完全匹配。
- Content
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
python ```bash npx clawhub search skill-name npx clawhub install skill-name npx clawhub update skill-name npx clawhub push skill-folder ```
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README promotes conversation sync and note-writing features without clearly warning that user and assistant messages may be persistently stored outside the chat context. In an agent skill, this is dangerous because users may not realize sensitive prompts, secrets, or personal data can be copied into long-lived notes and later exposed through the note system, backups, or other integrations.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The README describes syncing conversations into notes as a normal capability, which can lead operators to persist full chat contents in plain language storage. Because this skill is specifically designed for read/write note integration, the context makes the risk more concrete: chats may contain highly sensitive material that becomes searchable, backed up, and broadly accessible in the note environment.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documented auto_sync configuration encourages continuous persistence of conversation data but does not warn that this may archive sensitive content automatically over time. In this skill context, that increases the chance of silent collection and retention of personal data, credentials, or confidential workflow content.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The example code explicitly builds a conversation_data object containing complete user and assistant messages and syncs it to notes. This normalizes copying raw conversational content into persistent storage, increasing the risk that secrets, PII, or confidential instructions are retained and later disclosed.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The auto-sync example demonstrates ongoing archival of messages plus metadata, encouraging routine bulk retention of conversation history. In an agent environment, this is particularly risky because users may share credentials, internal documents, or sensitive personal information during normal interaction, all of which could be copied into the note system without sufficient awareness.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill documents capabilities that read environment variables, read/write local files, and access a networked SiYuan API, but it does not declare any explicit tool scope or permission boundaries. That omission increases the chance of over-broad execution or unexpected side effects because users and the host agent cannot easily see or constrain what resources the skill may touch.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill advertises write and sync behavior, including syncing conversations into SiYuan notes, but it does not prominently warn that invoking these features may export user conversation content into external/local note storage. Users may reasonably trigger the skill for note operations without understanding that sensitive chat data could be persisted beyond the current session.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The examples normalize syncing entire conversations, including user and assistant messages and summaries, into notes. This creates a straightforward data leakage path because secrets, personal data, or confidential prompts may be copied into long-lived storage without minimization or consent controls.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The batch and automatic synchronization guidance encourages exporting historical conversations at scale and marking them as synced, which can magnify privacy impact and retention risk. If used in a shared or sensitive environment, this could result in mass persistence of confidential history into another system with little friction or review.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The automatic synchronization section describes recurring export of conversations into SiYuan without an accompanying warning about persistent storage, privacy implications, or consent. Automated background syncing raises the risk of silent data retention and inadvertent export of sensitive content over time.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The documentation promotes creating documents and clipping external web content directly into SiYuan without any explicit warning about data modification, persistence, or the trustworthiness of imported content. In an agent skill context, this increases the risk of unintended writes to a user's notebook and storage of unreviewed external content, which can surprise users and lead to integrity or privacy issues.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The script performs a state-changing write to the user's SiYuan notebook immediately by calling create_document and then verifies the result, without any user confirmation, dry-run mode, or explicit authorization check at the point of execution. In an agent-skill context, this is dangerous because invoking the skill can silently create or modify user data, which can lead to unwanted persistence, workspace pollution, or abuse if triggered by an untrusted prompt or automation chain.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The module docstring says it creates a SiYuan document named 666, and the function docstring repeats that claim. However, the code later states that the existing method appends to an existing document and, on fallback, explicitly appends content to the first existing document in the notebook rather than creating a standalone document.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Around the main write path, the script prints that it is creating a document, but immediately comments that the method appends to an existing document. The fallback path also appends to the first available document, so the stated intent of creating a new note conflicts with the actual write semantics.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The script writes to SiYuan content immediately after connecting and selecting a notebook, with no interactive confirmation, dry-run mode, or explicit warning that existing notes may be modified. In an agent skill context, this is dangerous because automated execution can alter user data unexpectedly, including appending to the first available document in the fallback path.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The script performs a write into SiYuan notes immediately and then verifies the write, without any explicit user confirmation, dry-run mode, or safety prompt. In an agent-skill context, silent persistence is more dangerous because it can modify a user's knowledge base, create clutter, or store unreviewed/generated content without the user's informed consent.
- Content