T09 · Insecure Skill Coding Practices
Error
- Location
scripts/joplin_export.py:84- Finding
Export Operations Do Not Enforce the Documented Workspace Boundary
- Content
View full analysis
- Remediation
View remediation
Security audit
Joplin Api
Security checks for vulnerabilities and agentic risk
Overview
This Joplin note-management skill is mostly purpose-aligned, but its export feature can write outside the documented workspace boundary and it performs destructive note operations without strong safeguards.
Review before installing. Use it only with a trusted local Joplin Web Clipper endpoint or HTTPS remote endpoint, avoid remote plaintext HTTP, and treat delete and --permanent actions as high-risk. Do not rely on the stated export-directory restriction unless the export code is fixed to fail closed for paths outside JOPLIN_EXPORT_DIR.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/joplin_config.py:13- Finding
Joplin API Token May Be Transmitted over Plaintext HTTP and Exposed in Request URLs
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (55)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
A skill advertised as note management but actually performing local filesystem reads and bulk Markdown import expands trust boundaries beyond what a user would reasonably expect. That undisclosed disk access can expose or ingest sensitive local content from allowed directories, making the skill more dangerous in context than a pure REST-only integration.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
A skill advertised as note management but actually performing local filesystem reads and bulk Markdown import expands trust boundaries beyond what a user would reasonably expect. That undisclosed disk access can expose or ingest sensitive local content from allowed directories, making the skill more dangerous in context than a pure REST-only integration.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
A skill advertised as note management but actually performing local filesystem reads and bulk Markdown import expands trust boundaries beyond what a user would reasonably expect. That undisclosed disk access can expose or ingest sensitive local content from allowed directories, making the skill more dangerous in context than a pure REST-only integration.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
A skill advertised as note management but actually performing local filesystem reads and bulk Markdown import expands trust boundaries beyond what a user would reasonably expect. That undisclosed disk access can expose or ingest sensitive local content from allowed directories, making the skill more dangerous in context than a pure REST-only integration.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
A skill advertised as note management but actually performing local filesystem reads and bulk Markdown import expands trust boundaries beyond what a user would reasonably expect. That undisclosed disk access can expose or ingest sensitive local content from allowed directories, making the skill more dangerous in context than a pure REST-only integration.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
json "version": "0.1.3", "description": "Manage Joplin notes via REST API - create, read, update, delete, search, and organize notes programmatically", "author": "Cortana", "changelog": "Removed all .env location references from code and documentation", "tags": ["joplin", "notes", "api", "rest", "productivity", "latest"], "emoji": "📝", "category": "productivity",
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md - `GET /notes/:id` - Get single note - `POST /notes` - Create note - `PUT /notes/:id` - Update note - `DELETE /notes/:id` - Delete note ### Folders (Notebooks) - `GET /folders` - Get all notebooks
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md - `GET /folders/:id/notes` - Get notes in notebook - `POST /folders` - Create notebook - `PUT /folders/:id` - Update notebook - `DELETE /folders/:id` - Delete notebook ### Tags - `GET /tags` - Get all tags
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md ### Tags - `GET /tags` - Get all tags - `POST /tags` - Create tag - `DELETE /tags/:id` - Delete tag - `POST /tags/:id/notes/:note_id` - Add tag to note - `DELETE /tags/:id/notes/:note_id` - Remove tag from note
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md - `POST /tags` - Create tag - `DELETE /tags/:id` - Delete tag - `POST /tags/:id/notes/:note_id` - Add tag to note - `DELETE /tags/:id/notes/:note_id` - Remove tag from note ---
Lp1
High
- Category
- MCP Least Privilege
- Confidence
- 86% confidence
- Finding
The file launches other Python scripts via subprocess, which gives it process-execution capability even if it does not invoke a shell directly. In an agent skill ecosystem, undeclared execution capability is security-relevant because it can bypass operator expectations, expand the attack surface, and allow chained risky behavior in child scripts.
- Content
Lp1
High
- Category
- MCP Least Privilege
- Confidence
- 75% confidence
- Finding
The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
- Content
Lp1
High
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The script performs network operations to the Joplin REST API via requests.get/post, but the finding indicates this capability is not declared in permissions. Undeclared network access is dangerous in an agent skill because it can transmit note contents, titles, folder names, and auth-bearing parameters to an external service without clear user or platform authorization boundaries.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
python """ 删除笔记 根据官方文档：DELETE /notes/:id https://joplinapp.org/help/api/references/rest_api#delete-notesid 注意：默认移动到回收站，添加 --permanent 永久删除
Lp1
High
- Category
- MCP Least Privilege
- Confidence
- 94% confidence
- Finding
This script has file-write capability and can write arbitrary exported note content to the local filesystem, but the stated skill context only describes managing notes via REST API and does not clearly declare or constrain that local write capability. In an agent skill environment, undeclared file-write access is dangerous because it expands the attack surface and enables persistence or exfiltration to local files if the tool is invoked with attacker-chosen paths.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The docstring states that exports are restricted to the workspace directory, but both export_note() and export_all() only print a warning when the path is outside ALLOWED_BASE_DIRS and then proceed to create directories and write files anyway. This mismatch is security-relevant because users or higher-level agents may trust the documented restriction and unknowingly permit writes to unintended locations.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
python - GET /folders - 获取所有笔记本 - POST /folders - 创建笔记本 - PUT /folders/:id - 更新笔记本 - DELETE /folders/:id - 删除笔记本 用法: python3 joplin_folders.py list|create|rename|delete [参数]
Lp1
High
- Category
- MCP Least Privilege
- Confidence
- 75% confidence
- Finding
The skill uses 'file_read' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
python 根据官方文档: - GET /tags - 获取所有标签 - POST /tags - 创建标签 - DELETE /tags/:id - 删除标签 - POST /tags/:id/notes/:note_id - 添加标签到笔记 - DELETE /tags/:id/notes/:note_id - 从笔记移除标签
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
python - POST /tags - 创建标签 - DELETE /tags/:id - 删除标签 - POST /tags/:id/notes/:note_id - 添加标签到笔记 - DELETE /tags/:id/notes/:note_id - 从笔记移除标签 用法: python3 joplin_tags.py list|add|remove [参数]
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Documenting deletion capability without any warning or confirmation guidance increases the risk of accidental destructive use, especially in an agent-executed skill where commands may be run programmatically. In this context, the skill interfaces with a live personal knowledge base, so omitted safety messaging makes unintended data loss more plausible.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The documentation exposes destructive delete commands, including an optional permanent mode, without an explicit warning about irreversible data loss or guidance to confirm intent before use. In an agent skill context, terse command references can be copied directly into automation, increasing the chance of accidental or prompt-induced deletion of user notes.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
Notebook deletion is documented as a simple command with no warning about its destructive effect on user data organization and potentially associated notes. In a note-management skill, this is particularly risky because an agent or user may interpret it as a routine administrative action without appreciating the scope of loss.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python cmd = [sys.executable, script_path] + args try: result = subprocess.run(cmd, cwd=SCRIPT_DIR, check=True) return result.returncode except subprocess.CalledProcessError as e: sys.exit(e.returncode)
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script is presented as a note-creation tool, but when a named folder does not exist it also creates a new notebook as a side effect. This mismatch can lead to unintended state changes in the user's Joplin data and violates the principle of least surprise for destructive or state-mutating actions.
- Content
Static analysis
No suspicious patterns detected.