Security audit

思源笔记增强版

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches a SiYuan notes integration, but shipped credential-bearing test scripts and under-scoped conversation syncing create review-worthy risk.

Review this before installing. Use only with a SiYuan workspace you intend the agent to read and modify, avoid syncing secrets or full private transcripts, keep auto-sync disabled unless explicitly needed, prefer environment variables for the token, and remove or ignore the hard-coded debug/test scripts unless the publisher has rotated the exposed token and cleaned the package.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: debug_createdoc.py:9
Finding: Hard-Coded SiYuan API Credential Transmitted over Cleartext HTTP
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: siyuan_note.py:61
Finding: Unvalidated Configurable API Destination Receives the Authorization Token
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: siyuan_note.py:128
Finding: SiYuan API Token Persisted in Plaintext without Enforced File Permissions
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: siyuan_note.py:392
Finding: Document-Creation Fallback Can Silently Modify an Unrelated Existing Note
Content: View full analysis
Optional[str]: try: documents = self.get_documents(notebook_id) if not documents: return None parent_doc_id = documents[0].get('id') full_content = f"# {document_name}\n\n{content}" response = requests.post( f'{self.siyuan_config.api_url}/api/block/appendBlock', headers=self.headers, json={ 'data': full_content, 'dataType': 'markdown', 'parentID': parent_doc_id, 'nextID': '', 'previousID': '' }, timeout=10 ) if response.status_code == 200: result = response.json() if result.get('code') == 0: return parent_doc_id return None except Exception as e: return None ``` The fallback is invoked after independent document creation fails: ```python if result.get('code') != 0: return self._create_document_fallback( notebook_id, document_name, content ) ``` ### Technical Analysis The declared operation is document creation. If `createDocWithMd` fails, the implementation instead selects `documents[0]` and appends the requested content to that existing document. The first document returned by the API is not shown to be related to the requested document name or user intent. Its ordering may also change. The fallback therefore converts a failed creation operation into a write to an arbitrary existing note without explicit approval. An API compatibility failure, server error, malformed document name, or deliberately induced error is sufficient to activate this behavior. ### Attack ...[truncated 1068 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (98)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: The skill description emphasizes generic SiYuan read/write behavior, but the examples and workflows also include reading local conversation/history files and command-line supplied JSON for synchronization. That mismatch is dangerous because operators may approve the skill expecting only note interaction, while it also facilitates intake and transfer of other local/user data into the note system.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill description emphasizes generic SiYuan read/write behavior, but the examples and workflows also include reading local conversation/history files and command-line supplied JSON for synchronization. That mismatch is dangerous because operators may approve the skill expecting only note interaction, while it also facilitates intake and transfer of other local/user data into the note system.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill description emphasizes generic SiYuan read/write behavior, but the examples and workflows also include reading local conversation/history files and command-line supplied JSON for synchronization. That mismatch is dangerous because operators may approve the skill expecting only note interaction, while it also facilitates intake and transfer of other local/user data into the note system.
Content: No source excerpt is available for this finding.

Self-Modification

High

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · create_skills_list.py (reported line 266)May include surrounding context.
python
```bash npx clawhub search skill-name npx clawhub install skill-name npx clawhub update skill-name npx clawhub push skill-folder ```

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: All headings, descriptions, and example output in this file are presented only in Chinese, with no indication that the skill is region-specific or that users may choose another language. The policy explicitly flags language or locale constraints when they are imposed without user opt-in or justification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README advertises conversation syncing and note-writing features but does not clearly warn that user/assistant content may be persisted to an external note store. In an agent skill context, this can cause users or integrators to enable the feature without realizing sensitive prompts, secrets, or personal data may be archived.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Promoting automatic syncing of conversation content creates a clear path for natural-language leakage, where secrets, credentials, personal data, or internal prompts may be copied into persistent notes. Because the README presents this as a normal feature without boundaries, users may over-trust it and sync more data than intended.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The sample configuration sets auto_sync to true by default without a prominent warning that this may trigger ongoing background writes of conversation data. Default-on persistence in an agent integration increases the chance of unintended data retention and silent leakage into notes.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The example explicitly shows storing complete user and assistant messages in synchronized notes, normalizing full transcript archival. In practice, this can capture sensitive user inputs, model outputs containing secrets, or regulated data and persist them beyond the original session.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The auto-sync example encourages unattended archival of conversation histories and includes metadata showing automated operation, but it does not define consent, scoping, or exclusion rules. In an assistant skill, automation magnifies privacy risk because sensitive content may be stored continuously without user awareness at each sync event.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 97% confidence
Finding: The skill advertises and demonstrates capabilities that involve environment-variable access, local file reads/writes, and network calls, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates an authorization and review gap: an integrator or user cannot easily tell what the skill may access, increasing the chance of unintended data exposure or unsafe execution.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill documents syncing conversation data into SiYuan but does not prominently warn that user/assistant messages may be transmitted to the API and stored persistently. In a chat environment, this can lead to accidental retention of sensitive prompts, credentials, personal data, or proprietary content without sufficiently informed consent.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The examples normalize synchronizing full conversation contents, including user and assistant messages, into an external note system. Even if this is the intended feature, it creates a real data-handling risk because sensitive conversation material may be copied, retained, and later exposed through the notes platform.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The bulk-sync example instructs reading historical conversation JSON files from local storage and transferring them into SiYuan. This materially increases exposure because it enables collection and persistence of potentially large volumes of past user data, including data the user may not expect to be reprocessed or exported.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The auto-sync section describes automatically persisting unsynced conversations without a clear, prominent warning about privacy and data-retention consequences. This is risky because background synchronization can silently copy sensitive interactions into long-term storage, surprising users and violating least-expectation principles.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The continuous auto-sync narrative effectively describes ongoing logging of user interactions into an external note store. In context, this is dangerous because persistent background transfer can accumulate sensitive information over time with limited visibility, making accidental disclosure or over-retention more likely.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This is a markdown file, so SQP-2 applies to omissions in user-facing descriptions. The usage section shows document creation and article clipping operations that affect user data and send website information to the note system, but it does not include a warning or disclosure about these side effects.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The file’s docstrings, status messages, and generated document content are entirely in Chinese, including all user-facing console output and the created note body. This imposes a specific language/locale on users without opt-in or explanation, which matches the policy’s language/locale violation criterion.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The module docstring says it creates a SiYuan document named 666, and the function docstring repeats that claim. However, the primary path explicitly notes that create_document appends to an existing document, and the fallback path directly appends content to the first existing document in the notebook rather than creating a standalone note.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script performs write operations against SiYuan immediately after connection and notebook discovery, with no confirmation or interactive safeguard before modifying user content. In an agent-skill context, this creates a real risk of unauthorized or accidental data changes, especially because the fallback path may append to an unrelated existing document.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: When the primary creation path fails, the fallback logic selects the first existing document in the notebook and appends content to it without validating that it is an intended target. This can silently alter unrelated user notes, causing integrity loss and possible corruption of important content. The skill context increases the risk because it has write access to a real note store and operates on user data.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.