ClawHub
Back to skill

Security audit

Getnote Daily Sync

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says: it syncs today’s Get笔记 notes into Notion using the expected API credentials and network calls.

Install this only if you are comfortable giving the skill access to your Get笔记 API key, Notion token, and daily note contents. Use a Notion integration limited to the target database, review the optional Cron schedule before enabling it, and adjust the timezone if Asia/Shanghai is not appropriate.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (10)

Tainted flow: 'req' from os.environ.get (line 52, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/daily_sync.py (reported line 47)May include surrounding context.

python
def getnote_get(path):
    req = urllib.request.Request(f"{BASE_URL}{path}",
        headers={'Authorization': API_KEY, 'X-Client-ID': CLIENT_ID})
    with urllib.request.urlopen(req, timeout=15) as r:
        return json.loads(r.read())

def notion_req(method, path, body=None):

Tainted flow: 'req' from os.environ.get (line 52, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/daily_sync.py (reported line 60)May include surrounding context.

python
'Content-Type': 'application/json',
            'Notion-Version': '2022-06-28'
        })
    with urllib.request.urlopen(req, timeout=20) as r:
        return json.loads(r.read())

def append_blocks(page_id, blocks):

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill declares sensitive capabilities (environment secrets and outbound network access) but does not define an explicit tool scope such as permissions or allowed-tools. This creates ambiguity about what the skill is authorized to access, increasing the chance of over-broad execution or unintended secret/network use if the hosting agent interprets capabilities permissively.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill handles potentially sensitive note content and transmits it to external services, then creates new pages in Notion, but the user-facing description does not clearly warn about this data flow or side effect. Users may trigger the skill without realizing private recordings, meeting notes, and todos will be sent to biji.com/Notion APIs and persisted in another system.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The manifest description and documented triggers are broad enough to activate on several natural-language variants related to syncing or daily reports, without clearly constraining scope, confirmation requirements, or edge cases. In a skill that moves user notes and meeting records into Notion, ambiguous activation increases the risk of unintended execution and accidental data transfer.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The package manifest describes automatic syncing of recordings, meeting notes, and todos from Get笔记 into Notion, but does not include any user-facing privacy notice, consent flow, or warning that potentially sensitive content will be transmitted between third-party services. Because this skill handles personal and business notes, the lack of disclosure materially increases the risk of users exposing confidential data without informed consent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This file contains the primary description, environment variable guidance, and runtime output exclusively in Chinese. Under the policy, forcing a specific language without opt-in or justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/daily_sync.py (reported line 53)May include surrounding context.

python
def notion_req(method, path, body=None):
    data = json.dumps(body).encode() if body else None
    req = urllib.request.Request(
        f"https://api.notion.com/v1{path}",
        data=data, method=method,
        headers={
            'Authorization': f'Bearer {NOTION_TOKEN}',

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The cron example hard-codes the locale-specific timezone "Asia/Shanghai" in a user-facing configuration example. This can violate language/locale policy because it imposes a regional default without offering opt-in, alternatives, or explaining that the skill is intended only for that locale.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The natural-language description forces a specific language presentation and does not indicate that the skill is region-specific or provide any opt-in for language preference. Under the language/locale policy, a skill should not impose a single language unless that constraint is clearly justified or optional.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.