Write OpenNote
Security checks across static analysis, malware telemetry, and agentic risk
Overview
This skill appears to do what it says — it uses your OpenNote personal access token and curl to talk to api.opennote.cc and caches notes/labels locally; be aware it will read and write a local .opennote history and labels cache which can contain your note contents.
This skill is coherent with its stated purpose, but before installing consider: 1) It needs your OpenNote PAT (OPENNOTE_API_TOKEN) and will use it to create/update notes — only grant a token with the minimal scopes you need and revoke it if compromised. 2) The skill writes and reads .opennote/opennote-history.json and the labels cache in your working directory; those files will contain or reference your note contents and are read automatically at each invocation, so store them where you expect and don't share them. 3) If you want to avoid local persistence, run the skill in an isolated directory or remove/inspect the .opennote/ files after use. 4) The skill uses curl and the official api.opennote.cc endpoint — verify that matches your expectations. If any behavior (automatic history reads, random label selection) is surprising, ask the developer to change the defaults before using the skill with sensitive content.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
VirusTotal findings are pending for this skill version.
Risk analysis
No visible risk-analysis findings were reported for this release.