Write OpenNote

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:20 AM UTC
• Version: 1.0.0

Overview

The skill matches its note-writing purpose, but it needs Review because it stores local note previews and uses account-level API commands without enough safeguards.

Review before installing. Use a least-scoped, expiring OpenNote token, avoid using this skill for highly sensitive notes unless local history is disabled or cleared, and prefer safer request construction that serializes JSON and encodes URLs instead of interpolating user content into shell commands.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:335

Finding

Shell and JSON Injection Through Unsafe Construction of curl Commands

Content

View full analysis

.json", "time": , "content": "", "richContent": "", "stickerData": "", "diaryCoverImageName": null, "category": , "title": "", "imageList": [], "isDeleted": false, "lastModified": , "hideTitle": false }' ``` ```bash curl -s -X PUT "https://api.opennote.cc/api/v1/diaries/" \ -H "Authorization: Bearer $OPENNOTE_API_TOKEN" \ -H "Content-Type: application/json" \ -d '{ "content": "...", "richContent": "...", "lastModified": }' ``` ```bash curl -s "https://api.opennote.cc/api/v1/diaries?category=CATEGORY_ID&search=KEYWORD&limit=50&offset=0" \ -H "Authorization: Bearer $OPENNOTE_API_TOKEN" ``` ```bash curl -s "https://api.opennote.cc/api/v1/diaries/FILENAME.json" \ -H "Authorization: Bearer $OPENNOTE_API_TOKEN" ``` ### Technical Analysis The Skill directs an agent to place user-controlled note text, titles, search terms, filenames, and image paths directly into shell command templates. It does not require use of a JSON serializer, URL encoding, strict filename validation, or a subprocess API that passes arguments without invoking a shell. The JSON request body is enclosed in shell single quotes. If untrusted content is inserted into that body without robust serialization, an embedd ...[truncated 2226 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:385

Finding

Unnecessary Plaintext Retention and Unconditional Reading of Sensitive Note Previews

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (13)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

md

1. An **OpenNote account** — download the app from the [App Store](https://apps.apple.com/app/opennote-notes-journal/id6450187057)
2. A **Pro subscription** — API access is a Pro feature
3. A **Personal Access Token (PAT)** — generated from the app

### Generating an API token

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 78% confidence

Finding

The skill is explicitly designed for repeated use with a persistent environment token and additionally instructs maintenance of local cache and history files across invocations. That creates session persistence beyond a single task, increasing the chance that prior user data and account context are reused in later interactions without fresh consent.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

md

primaryEnv: OPENNOTE_API_TOKEN
---

# Write Note via OpenNote Public API

Write a note to [OpenNote](https://opennote.cc) using the public API at `https://api.opennote.cc/api/v1`.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

md

# Write Note via OpenNote Public API

Write a note to [OpenNote](https://opennote.cc) using the public API at `https://api.opennote.cc/api/v1`.

## Getting Started

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 101)May include surrounding context.

md

# Write Note via OpenNote Public API

Write a note to [OpenNote](https://opennote.cc) using the public API at `https://api.opennote.cc/api/v1`.

## Getting Started

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 335)May include surrounding context.

md

# Write Note via OpenNote Public API

Write a note to [OpenNote](https://opennote.cc) using the public API at `https://api.opennote.cc/api/v1`.

## Getting Started

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 355)May include surrounding context.

md

# Write Note via OpenNote Public API

Write a note to [OpenNote](https://opennote.cc) using the public API at `https://api.opennote.cc/api/v1`.

## Getting Started

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 377)May include surrounding context.

md

# Write Note via OpenNote Public API

Write a note to [OpenNote](https://opennote.cc) using the public API at `https://api.opennote.cc/api/v1`.

## Getting Started

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 430)May include surrounding context.

md

# Write Note via OpenNote Public API

Write a note to [OpenNote](https://opennote.cc) using the public API at `https://api.opennote.cc/api/v1`.

## Getting Started

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 453)May include surrounding context.

md

# Write Note via OpenNote Public API

Write a note to [OpenNote](https://opennote.cc) using the public API at `https://api.opennote.cc/api/v1`.

## Getting Started

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill directs the agent to maintain persistent local cache and history files, including a note history that is later consulted across invocations. Because the skill description does not clearly warn users that excerpts of their note content will be stored locally and reused, this creates an undisclosed privacy risk and broadens exposure of potentially sensitive user content beyond the immediate task.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

These instructions require the agent to always read prior local files and use them in future invocations, which causes cross-session retention and reuse of user data unrelated to the current request. That behavior can expose prior note information to later prompts, users, or contexts and violates data minimization expectations for a note-writing helper.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 335)May include surrounding context.

If the note includes images, upload each one first:

bash

curl -s -X POST "https://api.opennote.cc/api/v1/images" \
  -H "Authorization: Bearer $OPENNOTE_API_TOKEN" \
  -F "image=@/path/to/photo.jpg"

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Appending every created or updated note to a persistent local history log with title, content preview, timestamps, labels, and image indicators creates an accumulating shadow record of user content. Even partial previews can contain sensitive personal information, and the local log increases the attack surface compared with relying solely on the remote note service.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.