Security audit

Zettelkasten - 卡片笔记

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a local note-taking tool, but it ships an unsafe publishing helper and weak file scoping that users should review before installing or running it.

Install only if you are comfortable with local note persistence and Chinese runtime commands. Do not run publish.sh from a directory containing private files; if publishing is needed, package only an explicit allowlist of skill files and avoid using raw credentials in a broad upload script. The note database should be moved to a dedicated protected directory and user IDs should be sanitized or hashed before this is treated as low-risk.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: zettelkasten.py:17
Finding: Unsanitized User Identifier Controls the Note Database Path
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: publish.sh:20
Finding: Publishing Fallback Archives and Uploads the Entire Working Directory
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (16)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared purpose is local Zettelkasten note-taking, but the analyzed behavior includes reading credentials from ~/.clawhub/credentials, creating archives of local files, and making authenticated external network requests to publish data. That mismatch is highly suspicious because it suggests covert data collection and exfiltration beyond the user-expected scope of the skill.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The documented trigger phrase 'Record Idea: [your idea content]' is broad and does not define clear boundaries, confirmation requirements, or channel restrictions before the skill captures and stores user-provided content. In an agent environment, overly permissive activation can cause unintended invocation, accidental data capture, or abuse through prompt injection-style phrasing embedded in normal conversation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The README states that user ideas are automatically recorded and structured into notes, but it does not clearly warn users that their content will be stored. In a note-taking skill, users may enter sensitive personal thoughts, health details, work information, or intellectual property, so silent persistence creates a meaningful privacy and consent risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill advertises AI-generated expansions, relationship detection, and automatic retrieval of related concepts without explaining that user note content will be analyzed for inference and linkage. Because notes can contain highly personal or confidential material, undisclosed AI processing and semantic analysis increase privacy exposure beyond simple storage.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 82% confidence
Finding: The skill declares no explicit tool scope even though analysis detected capabilities consistent with file reads, file writes, and shell access. For a note-taking skill, undeclared powerful capabilities reduce user visibility and consent, making misuse or accidental overreach more likely.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: All visible prompts and usage instructions are presented in Chinese, including the required invocation phrase, with no indication that the skill is intentionally region-specific or that other languages are supported. This creates a language-policy concern because the skill imposes a specific locale on all users without opt-in.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · install.sh (reported line 5)May include surrounding context.
sh
echo "📦 正在安装 Zettelkasten 卡片盒笔记法..." # 创建技能目录 mkdir -p ~/.openclaw/skills/zettelkasten # 复制文件 cp zettelkasten.py ~/.openclaw/skills/zettelkasten/

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The fallback path creates a tarball from the current directory using tar -czf ... . and uploads it to a remote API, which can unintentionally include sensitive local files such as dotfiles, credentials, build artifacts, or unrelated workspace contents. Because the script gives no explicit warning, file manifest, or exclusion list, a user may transmit more data than intended.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · publish.sh (reported line 27)May include surrounding context.
sh
# 尝试用API发布 echo "📤 Publishing via API..." curl -X POST "https://api.clawhub.com/v1/skills" \ -H "Authorization: Bearer $(cat ~/.clawhub/credentials)" \ -F "slug=zettelkasten" \ -F "name=Zettelkasten - 卡片盒笔记法" \

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill persists user-provided note content to a local JSON database automatically, but the command flow never informs the user that their text will be stored on disk. This creates a privacy and consent issue because users may enter sensitive personal thoughts, health-related notes, or ideas assuming the interaction is ephemeral.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill not only stores the original user content but also automatically generates and saves derivative AI suggestion cards tied to the user's note, again without explicit notice or consent. This expands the amount of persisted potentially sensitive data and may infer additional topics about the user beyond what they expected to store.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The command interface only recognizes Chinese trigger phrases such as "记录灵感：", "每日回顾", and "统计", and all responses are produced in Chinese. This imposes a specific language/locale without any visible opt-in or alternative, which matches the language-policy violation criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The README instructions and examples are entirely in Chinese, which can amount to an implicit language constraint. There is no statement that the skill is Chinese-only, region-specific, or that users may choose another language.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The manifest name and description are entirely in Chinese, which suggests the skill may be presented in a fixed language without any stated opt-in or locale-specific justification. Under the policy rule, forcing a specific language can be a natural-language policy violation when no user choice is documented.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This shell script creates a directory under ~/.openclaw/skills and copies multiple files into it, which are user-visible filesystem modifications. While the script prints progress messages, it does not disclose that it will write into the user's home directory before doing so or ask for confirmation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The script reads an authentication token directly from ~/.clawhub/credentials and injects it into a network request without notifying the user or validating file permissions. While this is a common automation pattern, it increases the risk of unintended credential use, accidental disclosure through debugging/process inspection, or use from an unexpected account context.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.