Security audit

Craft Notes

Security checks for vulnerabilities and agentic risk

Overview

This Craft skill is mostly purpose-aligned, but it asks for broad note/task authority with weak scoping, plaintext persistent credential guidance, and undocumented destructive actions.

Review this before installing. Only use it for explicit Craft requests, avoid storing the Craft Connect URL permanently in a shell profile if possible, grant the narrowest Craft permissions available, and require confirmation before any delete or update command. The package also references an install script that is not present in the inspected artifact, so verify the actual CLI implementation before relying on it.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:15
Finding: Craft API Capability Persisted in Plaintext Shell Configuration## Vulnerability Details **File Location**: `SKILL.md`, lines 15-17 **Vulnerability Type**: Plaintext storage of a sensitive API capability **Risk Level**: Medium ### Vulnerable Code Snippet ```bash 3. Set env var: `export CRAFT_API_URL='https://connect.craft.do/links/YOUR_LINK/api/v1'` Add to shell profile for persistence. ``` ### Technical Analysis The documentation directs users to place a Craft Connect API URL in a persistent shell profile. The link may function as a bearer capability: possession of the complete URL can be sufficient to invoke the associated Craft API without separate credentials. Shell profiles store values as plaintext and may be exposed through account compromise, overly permissive file permissions, backups, diagnostic archives, terminal-sharing workflows, or tools that collect shell configuration. Exporting the value also propagates it to child processes, unnecessarily increasing the number of processes that can access the credential. This finding is limited to the insecure credential-handling instruction. The actual `scripts/craft` implementation is absent from the supplied project and therefore could not be inspected. ### Attack Path 1. A user follows the setup instructions and writes the complete `CRAFT_API_URL` value into a shell profile. 2. An attacker or untrusted local process obtains read access to that profile, a backup containing it, or the environment of a process that inherited the exported variable. 3. The attacker extracts the Craft Connect URL. 4. The attacker sends requests to the Craft API using that URL as the access capability. 5. Depending on the permissions assigned to the Craft Connect link, the attacker reads or searches documents and may create, modify, or delete documents, blocks, and tasks. This path requires access to the stored profile, an inherited process environment, or another artifact containing the URL; the documentation alone does not provide remote access ...[truncated 563 chars]
Remediation: ## Remediation Suggestions 1. Do not recommend storing the complete Craft Connect URL directly in a shell profile. 2. Store the URL in the macOS Keychain or another dedicated secret manager and retrieve it only when the CLI runs. 3. If an environment variable is unavoidable, inject it only for the individual command rather than exporting it globally to all child processes. 4. Ensure any fallback credential file is excluded from version control and backups where appropriate, and restrict its permissions to the owning user, such as mode `0600`. 5. Document how users can revoke and rotate a Craft Connect link after suspected disclosure. 6. Advise users to grant the minimum Craft permissions and scope required for their intended operations. 7. Avoid printing the full URL in logs, error messages, shell tracing output, command history, or diagnostic reports.

SkillSpector

Vulnerability Patterns

Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The manifest description says to use the skill when the user asks to 'add notes, create documents, manage tasks, search their Craft documents, or work with daily notes,' which is a wide set of generic requests without clear boundaries or exclusion conditions. This can cause unintended invocation for everyday note or task requests, especially when the user has not explicitly indicated they want to use Craft.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill exposes destructive commands like delete-block and delete-task without any warning, confirmation guidance, or indication that the actions are irreversible. In an agent setting, this increases the chance of accidental or unauthorized data deletion if the skill is triggered on ambiguous user requests or the agent misinterprets intent.

Session Persistence

Medium

Category: Rogue Agent
Content: ```bash craft tasks [scope] # List tasks (inbox, active, upcoming, logbook) craft add-task "text" [scheduleDate] # Add task to inbox craft complete-task <id> # Mark task as done craft delete-task <id> # Delete task ```
Confidence: 80% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Static analysis

No suspicious patterns detected.