YoudaoNote

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:14 AM UTC
• Version: 1.0.9

Overview

The skill is coherent for managing YoudaoNote, but its setup instructions include an unpinned remote shell installer that users are asked to run manually.

Review the installer path before using this skill. Prefer downloading and inspecting the script first, and look for a version-pinned or checksum-verified install method before running it. Once installed, remember the skill can read, create, update, move, and delete notes and todos in the connected YoudaoNote account.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:173

Finding

Unverified Remote Installer Executed Through Bash

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 173
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code

bash

curl -fsSL https://artifact.lx.netease.com/download/youdaonote-cli/install.sh | bash -s -- -f -b ~/.local/bin

Technical Analysis

The installation instructions retrieve a shell script from an external URL and pipe the response directly into Bash. The executed content is not included in the audited project and can change after review. The command provides no version pinning, checksum verification, or cryptographic signature validation.

Although the document identifies the endpoint as an official source, that claim does not guarantee the integrity of every future response. A compromised download service, release process, DNS/TLS path, or hosting account could replace the installer with arbitrary shell commands. Asking the user to execute the command manually prevents automatic execution by the Agent, but it does not eliminate the remote-code-execution channel.

Installing the required CLI is relevant to the Skill's declared functionality, and targeting ~/.local/bin avoids an explicitly system-wide installation. Nevertheless, executing mutable network content directly in a shell exceeds the minimum privilege and trust required to install the dependency. A pinned, integrity-verified artifact would fulfill the same purpose with a smaller supply-chain attack surface.

Attack Path

1. The youdaonote CLI is absent or requires an upgrade.
2. The Skill presents the installation command to the user.
3. The user runs the command in a terminal.
4. curl retrieves the current response from the external installer endpoint.
5. Bash immediately interprets and executes that response without integrity verification or prior inspection.
6. If the endpoint or delivery chain has been compromised, attacker-controlled commands execute with the user's pr ...[truncated 759 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the direct curl | bash installation command.
2. Distribute the CLI through a trusted package manager or an immutable, version-specific release artifact.
3. Pin the required CLI version rather than downloading a mutable latest installer.
4. Publish a SHA-256 checksum and, preferably, a cryptographic signature from a separately secured channel.
5. Require downloading the artifact first, verifying its checksum or signature, and executing it only after successful verification.
6. Preserve the existing user-confirmation boundary: the Agent should not execute installers or perform unrelated system changes.
7. Apply the same pinning and verification requirements to upgrades; do not fall back to an unverified remote installer.
8. If a script remains necessary, use a workflow such as:

bash

curl -fsSLo install.sh 'https://example.invalid/versioned/install.sh'
printf '%s  %s\n' 'PUBLISHER_PROVIDED_SHA256' 'install.sh' | sha256sum -c -
less install.sh
bash install.sh -f -b "$HOME/.local/bin"

The actual URL and checksum must correspond to an immutable, publisher-authenticated release.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 95% confidence

Finding

This duplicate finding identifies the same install flow that fetches a shell script from an external URL and then runs it locally. In the context of an agent skill, this is more dangerous because users may over-trust vendor-branded setup instructions and execute them without independent validation, amplifying supply-chain compromise impact.

Content

Scanner excerpt · SKILL.md (reported line 164)May include surrounding context.

bash

# 步骤 1：下载脚本到本地
curl -fsSL https://artifact.lx.netease.com/download/youdaonote-cli/install.sh -o install.sh
# 步骤 2：审查脚本内容
cat install.sh
# 步骤 3：确认无误后执行

External Script Fetching

High

• Category: Supply Chain
• Confidence: 95% confidence

Finding

This duplicate finding identifies the same install flow that fetches a shell script from an external URL and then runs it locally. In the context of an agent skill, this is more dangerous because users may over-trust vendor-branded setup instructions and execute them without independent validation, amplifying supply-chain compromise impact.

Content

Scanner excerpt · SKILL.md (reported line 164)May include surrounding context.

bash

# 步骤 1:下载脚本到本地
curl -fsSL https://artifact.lx.netease.com/download/youdaonote-cli/install.sh -o install.sh
# 步骤 2:审查脚本内容
cat install.sh
# 步骤 3:确认无误后执行

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The natural-language content of the skill, including the description, operating instructions, prompts, and safety guidance, is written exclusively in Chinese. Under the policy, forcing a specific language without user opt-in is a locale/language policy violation unless the skill explicitly offers a language choice or clearly documents a justified region-specific constraint.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.

✅ 短内容可直接内联（无换行/特殊字符时）

printf '%s\n' '{"title":"笔记","contentFormat":"md","content":"# 标题\n\n内容"}' | youdaonote -s ydn save

⚠️ 仅纯文本，不支持 Markdown 格式，有格式需求时禁用

youdaonote -s ydn create -n "标题" -c "纯文本内容"

text

### 其他操作

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.

✅ 短内容可直接内联(无换行/特殊字符时)

printf '%s\n' '{"title":"笔记","contentFormat":"md","content":"# 标题\n\n内容"}' | youdaonote -s ydn save

⚠️ 仅纯文本,不支持 Markdown 格式,有格式需求时禁用

youdaonote -s ydn create -n "标题" -c "纯文本内容"

text

### 其他操作

Static analysis

No suspicious patterns detected.