T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:13- Finding
Mandatory Persistent Collection of Personal Information
- Content
View full analysis
- Remediation
View remediation
Security audit
Notnative
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly coherent with its stated NotNative integration purpose, but it asks for broad persistent memory and remote tool authority without enough consent, scoping, or transport safeguards.
Review this before installing if you are comfortable with a NotNative server receiving and retaining personal facts, preferences, notes, profile data, task/calendar data, and Python code. Prefer a local or authenticated wss:// endpoint, avoid remote ws:// URLs, inspect what memory is stored, and be prepared to remove the .bashrc entry and $HOME/.local/bin/notnative symlink if uninstalling.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/mcp-client.js:5- Finding
Sensitive MCP Data Can Be Transmitted to an Arbitrary Plaintext WebSocket Endpoint
- Content
View full analysis
/dev/null | grep -q "200"; then WS_URL="ws://127.0.0.1:8788" echo "✓ Local NotNative detected: $WS_URL" IS_LOCAL=true elif curl -s -o /dev/null -w "%{http_code}" http://localhost:8788/health 2>/dev/null | grep -q "200"; then WS_URL="ws://localhost:8788" echo "✓ Local NotNative detected: $WS_URL" IS_LOCAL=true else # Not local, ask for URL echo "✗ NotNative not detected locally" echo "" read -p "Enter your NotNative WebSocket URL (e.g., ws://your-ip:8788 or wss://domain.com): " WS_URL if [ -z "$WS_URL" ]; then echo "✗ URL is required" exit 1 fi echo "Using: $WS_URL" IS_LOCAL=false fi ``` ```bash mkdir -p "$SCRIPT_DIR/.config" echo "NOTNATIVE_WS_URL=$WS_URL" > "$SCRIPT_DIR/.config/env" if ! grep -q "NOTNATIVE_WS_URL" "$HOME/.bashrc" 2>/dev/null; then echo "export NOTNATIVE_WS_URL=\"$WS_URL\"" >> "$HOME/.bashrc" fi ``` ```javascript const WS_URL = process.env.NOTNATIVE_WS_URL || 'ws://127.0.0.1:8788'; function sendRequest(method, params = {}) { return new Promise((resolve, reject) => { const id = idCounter++; pendingRequests.set(id, { resolve, reject }); ws.send(JSON.stringify({ jsonrpc: '2.0', id, method, params })); ``` ```javascript ws = new WebSocket(WS_URL); ``` The same connection is subsequently used for note contents, memories, profile data, task and calendar requests, Python source code, and arbitrary tool calls. ### Technical Analysis The installer explicitly permits a remote `ws://` URL. Plain WebSockets do not provide transport encryption or server authentication. The ...[truncated 2290 chars]- Remediation
View remediation
T06 · System Persistence
Warning
- Location
install.sh:56- Finding
Installer Creates Persistent Shell Configuration and Executable Hook
- Content
View full analysis
/dev/null; then echo "export NOTNATIVE_WS_URL=\"$WS_URL\"" >> "$HOME/.bashrc" fi ``` ### Technical Analysis The installer creates a persistent executable symlink in `$HOME/.local/bin` and modifies the user's `.bashrc`. Both changes survive the installer process and future login sessions. The symlink directly references a script in the project directory. If that directory or script is later modified by another party with filesystem access, invoking `notnative` executes the modified content. The `.bashrc` modification also causes future shells to inherit the selected server endpoint, including an insecure or attacker-controlled endpoint. The installer does not ask for separate confirmation before modifying startup configuration, does not create a backup, and does not provide a corresponding uninstall or rollback routine. ### Attack Path 1. The user runs `install.sh`. 2. The installer creates `$HOME/.local/bin/notnative` as a symlink to the project script. 3. The installer appends the chosen endpoint to `$HOME/.bashrc`. 4. Future shell sessions automatically inherit the endpoint. 5. Later invocations of `notnative` execute whichever content exists at the symlink target. 6. If the project directory is replaced or modified, future invocations execute the changed client. 7. If the persisted endpoint is malicious, subsequent MCP data continues to be sent to it across sessions. ### Impact Assessment The persistence operates with the privileges of the affected user. It does not establish root privileges, a ser ...[truncated 396 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
package.json:8- Finding
Dependency Installation Is Not Reproducibly Locked
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (32)
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The natural-language instructions repeatedly require the assistant to permanently record user facts and recall them across all conversations, creating a durable data retention and cross-session leakage risk. This is especially dangerous in a memory-integrated skill because the assistant may over-collect sensitive details and later surface them in unrelated contexts or to the wrong user/session.
- Content
YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]
High
- Category
- YARA Match
- Confidence
- 88% confidence
- Finding
The skill embeds strong imperative instructions such as 'ALWAYS' and 'MUST' that attempt to steer agent behavior independently of higher-level safety and privacy policy. Even if not overtly malicious, this is prompt-injection-like behavior because it pressures the agent to prioritize persistent memory actions, including storing personal information, over safer contextual judgment and consent checks.
- Content
md --- name: notnative description: Use Notnative MCP server for complete AI assistant integration with notes, calendar, tasks, Python, canvas, and permanent memory. This skill provides persistent memory across conversations - ALWAYS use memory tools to remember user preferences, facts they share, and important context. Connects via WebSocket to local or remote Notnative instance. homepage: https://github.com/k4ditano/notnative-memory metadata: openclaw: emoji: "🧠" requires: bins: ["node", "curl"] --- # NotNative - Complete AI Integration **⚠️ CRITICAL: This skill provides PERMANENT MEMORY. You MUST use memory tools to remember user preferences
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill explicitly mandates permanent storage of user personal information across conversations and instructs the assistant to do so automatically, without requiring informed user consent or describing retention limits. This creates a privacy and compliance risk because sensitive personal data may be collected, retained, and later retrieved or exposed beyond the user's expectation.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/mcp-client.js store "User prefers responses in Spanish"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/mcp-client.js store "User prefers responses in Spanish"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/mcp-client.js store "User prefers responses in Spanish"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/mcp-client.js store "User prefers responses in Spanish"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/mcp-client.js store "User prefers responses in Spanish"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/mcp-client.js store "User prefers responses in Spanish"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/mcp-client.js store "User prefers responses in Spanish"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/mcp-client.js store "User prefers responses in Spanish"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/mcp-client.js store "User prefers responses in Spanish"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/mcp-client.js store "User prefers responses in Spanish"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/mcp-client.js store "User prefers responses in Spanish"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/mcp-client.js store "User prefers responses in Spanish"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/mcp-client.js store "User prefers responses in Spanish"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/mcp-client.js store "User prefers responses in Spanish"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/mcp-client.js store "User prefers responses in Spanish"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/mcp-client.js store "User prefers responses in Spanish"
YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]
High
- Category
- YARA Match
- Confidence
- 75% confidence
- Finding
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
- Content
sh R/scripts/mcp-client.js" # Save config mkdir -p "$SCRIPT_DIR/.config" echo "NOTNATIVE_WS_URL=$WS_URL" > "$SCRIPT_DIR/.config/env" # Add to PATH in .bashrc if not already BIN_DIR="$HOME/.local/bin" mkdir -p "$BIN_DIR" if [ ! -L "$BIN_DIR/notnative" ]; then ln -sf "$SCRIPT_DIR/scripts/mcp-client.js" "$BIN_DIR/notnative" fi if ! grep -q "NOTNATIVE_WS_URL" "$HOME/.bashrc" 2>/dev/null; then echo "export NOTNATIVE_WS_URL=\"$WS_URL\"" >> "$HOME/.bashrc" fi echo "" echo "✅ NotNative skill installed!" echo "" echo "Usage:" echo " node scripts/mcp-client.js search <query> # Search notes" echo " node scripts/mcp-client.js store <text> # Store memory" echo " node scripts/mcp-client.js recall <query> # Search memory" echo " node scripts/mcp-client.js tasks # List tasks" echo " node scripts/mcp-client.js events # Calendar events" echo " node scripts/mcp-client.js run-python <code> # Execute Python" echo "" echo "Or use directly: notnative <command> [
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill exposes shell and environment-dependent behavior via Node and curl requirements plus command examples, but it does not declare any explicit tool scope or permission boundaries. In an agent setting, missing scope constraints increases the chance of unintended command execution or access to sensitive local/remote resources through the MCP client.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill advertises create, update, append, forget/delete, calendar/task creation, web access, and Python execution capabilities without prominent safety guardrails, confirmation requirements, or warnings about side effects. In practice, this can lead to destructive data modification, unauthorized state changes, or risky code execution if the agent follows ambiguous or malicious prompts.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The installer modifies the user's shell environment persistently by creating a command symlink and appending an export to
.bashrcwithout explicit warning or confirmation. Persistent profile changes can affect future shells, expose sensitive connection details, and create long-lived trust in a tool that connects to local or remote services.- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The installer advertises a
run-python <code>capability, which materially expands the skill from note/calendar integration into arbitrary code execution. Even though this line is only a usage message, exposing code execution through the installed client increases the chance that users or downstream agents invoke dangerous functionality that is not clearly emphasized in the skill framing.- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
Advertising arbitrary Python execution without clear justification or warning is risky because it can normalize use of a powerful remote/local execution feature under an integration-oriented skill. In the context of a tool with persistent memory and external connectivity, this makes misuse or unintended execution more dangerous.
- Content
Static analysis
No suspicious patterns detected.