ClawHub
Back to skill

Security audit

Joplin Cli

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Joplin CLI helper, but it needs Review because its docs include broad note-changing and sync workflows, plaintext password examples, and uninstall commands that can erase local Joplin data.

Install only if you are comfortable letting the agent operate on your Joplin profile. Verify the active notebook/profile before write or delete commands, back up notes before using uninstall or force-delete examples, avoid putting real sync passwords directly in shell commands, and confirm any remote sync target before running `joplin sync`.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
references/INSTALL.md:12
Finding

Unpinned Third-Party Package Installation

Content
View full analysis

Vulnerability Details

File Location: references/INSTALL.md:12-15 and references/INSTALL.md:23
Vulnerability Type: Unpinned executable dependencies from npm and the Arch User Repository
Risk Level: Medium

Vulnerable Code

bash
# Ubuntu/Debian:
sudo apt install nodejs npm

# Install Joplin Terminal
NPM_CONFIG_PREFIX=~/.joplin-bin npm install --loglevel=error -g joplin

The alternative installation method also uses an unpinned AUR package:

bash
yay -S joplin

Technical Analysis

The instructions install the latest package available under the joplin name without pinning a reviewed version or verifying a cryptographic integrity value. npm package installation may execute package lifecycle scripts with the privileges of the installing user. The AUR method similarly relies on community-maintained package build instructions that can execute local build or installation commands.

No evidence indicates that the current Joplin package is malicious. The security issue is that the effective executable dependency may change after the Skill has been reviewed. A compromised publisher account, package registry, dependency, or AUR build recipe could consequently introduce arbitrary code without requiring any modification to this project.

The use of sudo for package installation and symlink creation also increases the consequences of following installation instructions without first verifying package provenance, although the npm command itself uses a user-local prefix.

Attack Path

  1. An attacker compromises the relevant package publisher, dependency, registry delivery path, or AUR build recipe.
  2. The compromised source publishes malicious code under the expected package name or as a transitive dependency.
  3. A user follows the documented installation command without a pinned version or integrity verification.
  4. npm lifecycle scripts or AUR build and installation logic execute the attacker-controlled code.
  5. The malicious ...[truncated 884 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin installation to a specific, reviewed Joplin version rather than implicitly installing the latest release.
  2. Document the expected official package publisher and authoritative package source.
  3. Verify package integrity using a trusted digest, signed release artifact, or registry integrity metadata where supported.
  4. Review npm lifecycle scripts and relevant transitive dependencies before recommending a release for automated installation.
  5. For AUR installation, instruct users to inspect the PKGBUILD and associated source files before building.
  6. Prefer official signed distribution packages where available.
  7. Avoid elevated installation steps unless they are necessary. For command discovery, prefer adding the user-local binary directory to PATH instead of creating a root-owned system symlink.
  8. Periodically review and deliberately update the pinned version after validating release provenance and security changes.

T09 · Insecure Skill Coding Practices

Warning
Location
references/INSTALL.md:77
Finding

Synchronization Passwords Entered as Command-Line Arguments

Content
View full analysis

Vulnerability Details

File Location: references/INSTALL.md:77-106; duplicated in references/COMMANDS.md:144-152
Vulnerability Type: Exposure of authentication secrets through command-line arguments and shell history
Risk Level: Medium

Vulnerable Code

bash
# Nextcloud
joplin config sync.target 5
joplin config sync.5.path "https://example.com/nextcloud/remote.php/webdav/Joplin"
joplin config sync.5.username "your username"
joplin config sync.5.password "your password"
joplin sync
bash
# WebDAV
joplin config sync.target 6
joplin config sync.6.path "https://webdav.example.com/Joplin"
joplin config sync.6.username "username"
joplin config sync.6.password "password"
joplin sync
bash
# Joplin Cloud
joplin config sync.target 10
joplin config sync.10.username "your email"
joplin config sync.10.password "your password"
joplin sync

Equivalent Nextcloud and WebDAV password commands are also documented in references/COMMANDS.md.

Technical Analysis

The documentation instructs users to substitute real synchronization passwords directly into command-line arguments. Secrets supplied this way may be exposed through:

  • Persistent shell history.
  • Terminal session logging.
  • Process argument inspection while the command is running.
  • Audit or monitoring systems that record executed commands.
  • Support bundles, backups, or synchronization of shell history files.
  • Automation logs if the examples are copied into scripts or CI jobs.

Quoting a password only affects shell parsing; it does not prevent the argument from being recorded or observed. The project does not hardcode an actual credential, but its recommended secret-entry method creates a repeatable credential-disclosure risk.

Attack Path

  1. A user replaces the placeholder with a real Nextcloud, WebDAV, or Joplin Cloud password.
  2. The user executes the command in an interactive shell or automation environment.
  3. The command, including the plaintext password, is ...[truncated 1026 chars]
Remediation
View remediation

Remediation Suggestions

  1. Prefer an interactive password prompt that does not echo input and does not place the secret in process arguments.
  2. Use the Joplin-supported secure credential storage mechanism, if available for the deployed version and platform.
  3. If an interactive secure method is unavailable, clearly warn users that literal passwords in command lines may be recorded or observed.
  4. Do not place synchronization passwords in reusable scripts, command examples, environment files committed to source control, or CI logs.
  5. Provide platform-specific instructions for protected secret stores or restricted configuration files.
  6. Advise affected users to remove commands containing passwords from shell history and any retained terminal or automation logs.
  7. Recommend rotating any credential that was entered using the documented method and may have been exposed.
  8. Ensure local files containing synchronization secrets have restrictive permissions and are excluded from backups or support bundles unless properly encrypted.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (17)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/INSTALL.md (reported line 156)May include surrounding context.

bash
npm uninstall -g joplin
sudo rm /usr/local/bin/joplin
rm -rf ~/.joplin-bin
rm -rf ~/.config/joplin   # 同时删除数据

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

rm -rf ~/.joplin-bin is a forceful recursive deletion command that permanently removes the local Joplin installation directory. In an automation-oriented CLI skill, users may execute it without understanding the scope, and rm -rf leaves little room for recovery if paths are misread or modified.

Content

Scanner excerpt · references/INSTALL.md (reported line 157)May include surrounding context.

bash
npm uninstall -g joplin
sudo rm /usr/local/bin/joplin
rm -rf ~/.joplin-bin
rm -rf ~/.config/joplin   # 同时删除数据

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

rm -rf ~/.joplin-bin is a forceful recursive deletion command that permanently removes the local Joplin installation directory. In an automation-oriented CLI skill, users may execute it without understanding the scope, and rm -rf leaves little room for recovery if paths are misread or modified.

Content

Scanner excerpt · references/INSTALL.md (reported line 157)May include surrounding context.

bash
npm uninstall -g joplin
sudo rm /usr/local/bin/joplin
rm -rf ~/.joplin-bin
rm -rf ~/.config/joplin   # 同时删除数据

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
97% confidence
Finding

rm -rf ~/.config/joplin forcefully and recursively deletes the Joplin configuration/data directory, which likely contains local notes, sync settings, and possibly cached sensitive content. In the context of a note-taking CLI with synchronization credentials and user data, this can cause irreversible data loss and operational disruption if copied blindly.

Content

Scanner excerpt · references/INSTALL.md (reported line 158)May include surrounding context.

npm uninstall -g joplin sudo rm /usr/local/bin/joplin rm -rf ~/.joplin-bin rm -rf ~/.config/joplin # 同时删除数据

text

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
97% confidence
Finding

rm -rf ~/.config/joplin forcefully and recursively deletes the Joplin configuration/data directory, which likely contains local notes, sync settings, and possibly cached sensitive content. In the context of a note-taking CLI with synchronization credentials and user data, this can cause irreversible data loss and operational disruption if copied blindly.

Content

Scanner excerpt · references/INSTALL.md (reported line 158)May include surrounding context.

npm uninstall -g joplin sudo rm /usr/local/bin/joplin rm -rf ~/.joplin-bin rm -rf ~/.config/joplin # 同时删除数据

text

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill exposes commands that can create, modify, and sync Joplin notes, but it does not warn that these operations change local user data and may transmit note contents to a configured remote sync target. In an automation or agent setting, this omission can cause unintended data loss, overwrites, or disclosure of sensitive notes because users may assume the skill is read-only or purely local.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This markdown file documents notebook deletion, including a force-delete variant, but does not warn users that the operation may permanently remove data or bypass confirmation. Under the markdown-specific missing-warning rule, destructive actions affecting user data should be accompanied by an explicit warning.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The file shows rmnote and rmnote -f usage but does not disclose that deleting notes can result in loss of user data or that force mode removes the confirmation safeguard. This omission fits the markdown-file warning criterion for behaviors that affect user data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The sync section shows how to configure remote backends and run synchronization, including entering usernames and passwords, without warning that note contents and credentials may be transmitted to third-party services or exposed in shell history/logs. In an agent skill context, this is more dangerous because users may treat the instructions as turnkey automation and unknowingly send sensitive notebook data off-device.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/INSTALL.md (reported line 12)May include surrounding context.

bash
# 安装 Node.js 12+（如果未安装）
# Ubuntu/Debian:
sudo apt install nodejs npm

# 安装 Joplin 终端版
NPM_CONFIG_PREFIX=~/.joplin-bin npm install --loglevel=error -g joplin

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/INSTALL.md (reported line 18)May include surrounding context.

bash
# 安装 Node.js 12+（如果未安装）
# Ubuntu/Debian:
sudo apt install nodejs npm

# 安装 Joplin 终端版
NPM_CONFIG_PREFIX=~/.joplin-bin npm install --loglevel=error -g joplin

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The uninstall section includes destructive rm -rf commands that permanently delete the Joplin binary directory and the user's Joplin data/configuration directory, but the warning is only an inline comment and does not clearly emphasize irrecoverable note loss. In a CLI automation context, users may copy-paste these commands without realizing they will erase all local notes and settings.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
84% confidence
Finding

The uninstall sequence uses sudo rm /usr/local/bin/joplin, which is a privileged deletion command presented as a copy-paste step. While targeted, combining sudo with deletion increases risk of accidental destructive execution, especially in installation guides intended for broad use.

Content

Scanner excerpt · references/INSTALL.md (reported line 156)May include surrounding context.

bash
npm uninstall -g joplin
sudo rm /usr/local/bin/joplin
rm -rf ~/.joplin-bin
rm -rf ~/.config/joplin   # 同时删除数据

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

SQP-3 applies to all file types and includes language or locale policy violations. The natural-language description is presented only in Chinese, which can force a specific language on users without opt-in or explanation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

The manifest description is written entirely in Chinese and does not indicate that users can choose another language or that the skill is intentionally limited to a Chinese-speaking audience. This can conflict with language/locale policy requirements when a skill implicitly forces one language without opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

This example prescribes a specific language/locale setting in natural language documentation, which can be read as instructing users to force a locale without opt-in. The policy requires either offering a choice or clearly justifying the locale constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

A natural-language policy issue is present because the skill content forces a specific language/locale for all users. The file does not provide an opt-in, alternative language, or explanation that the Chinese-only format is required for a region-specific use case.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.