ClawHub
Back to skill

Security audit

RemNote Notes

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly aligned with RemNote note management, but it can install an unpinned global npm package and automatically restart a shared OpenClaw browser profile during recovery.

Install only if you are comfortable with a global npm-based RemNote CLI/server and with the agent managing the OpenClaw browser during troubleshooting. Prefer pinning remnote-mcp-server to a reviewed exact version, avoid admin-level global installs, and require confirmation before any browser stop/start recovery action.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:13
Finding

Unpinned Global npm Package Installation Creates Supply-Chain Exposure

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:13-18, with related installation instructions at SKILL.md:46 and SKILL.md:108-111
Vulnerability Type: Unpinned third-party dependency installed globally
Risk Level: Medium

Vulnerable Code

yaml
"install":
  [
    {
      "id": "node",
      "kind": "node",
      "package": "remnote-mcp-server",

Related installation instructions:

text
- Preferred install: `npm install -g remnote-mcp-server`
text
- Install matching server package version:
  - Exact: `npm install -g remnote-mcp-server@<plugin-version>`
  - Or same minor line (`0.<minor>.x`) when exact is unavailable.

Technical Analysis

The default installation configuration identifies remnote-mcp-server without an exact version or integrity hash. The documented preferred command consequently installs whichever release is associated with the package's current npm distribution tag.

npm packages can run lifecycle scripts during installation. A malicious or compromised future package release could therefore execute code under the privileges of the user performing the global installation. Global installation increases the affected scope by placing executables and package files in shared user-level or system-level npm locations.

The compatibility procedure recommends an exact runtime-derived plugin version when available, which is safer than an unversioned installation. However, it does not require a reviewed version, lockfile, checksum, signature, trusted registry configuration, or integrity verification. The same-minor fallback also permits installation of package contents that were not reviewed with this Skill.

Attack Path

  1. An attacker compromises the npm package, a maintainer account, the publication process, or a transitive dependency.
  2. The attacker publishes a malicious release and makes it eligible for the unpinned package specificat ...[truncated 1168 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin remnote-mcp-server to a specifically reviewed exact version in both the metadata installer and documentation.
  2. Verify the package artifact using an expected integrity hash or a cryptographically authenticated release process.
  3. Use a lockfile where package management permits it so transitive dependencies are also reproducible.
  4. Configure npm to use an explicitly trusted registry and reject unexpected registry substitution.
  5. Prefer a project-local or isolated installation rather than npm install -g.
  6. Avoid administrative installation and run the CLI using a dedicated least-privileged account or sandbox.
  7. Disable npm lifecycle scripts during installation where compatible, then explicitly run only reviewed setup actions.
  8. Do not automatically install a version solely because it is reported by a runtime component. Validate it against an allowlist of reviewed compatible versions.
  9. Document a controlled upgrade process that reviews new package and transitive-dependency versions before changing the pin.

T09 · Insecure Skill Coding Practices

Note
Location
SKILL.md:196
Finding

Automatic Shared Browser Restart Can Disrupt Unrelated Browser Activity

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:196-200
Vulnerability Type: Destructive browser lifecycle operation without explicit confirmation
Risk Level: Low

Vulnerable Code

text
- use the OpenClaw-managed browser CLI against profile `openclaw` to try browser-side recovery:
  - `openclaw browser --browser-profile openclaw status`
  - if the CLI is reachable, run:
    - `openclaw browser --browser-profile openclaw stop`
    - `openclaw browser --browser-profile openclaw start`
    - `openclaw browser --browser-profile openclaw open https://www.remnote.com/`

Technical Analysis

The recovery procedure instructs the Agent to stop and restart the OpenClaw-managed browser profile whenever the browser tool is unavailable and the CLI can be reached. Stopping a browser is a state-changing and potentially destructive operation because the profile may contain unrelated active pages, in-progress work, authenticated sessions, or volatile state.

The Skill's confirm write safeguard covers RemNote mutations only. It does not require user confirmation before stopping the shared browser profile. The recovery logic also does not first establish that the browser instance is dedicated exclusively to RemNote or that a restart is necessary and safe.

This is not a privilege-escalation path: the commands use only browser-management authority already available to the Agent. The weakness is the excessive and insufficiently gated use of that authority during failure recovery.

Attack Path

  1. A RemNote bridge-backed operation fails.
  2. The ordinary browser tool is unavailable during recovery.
  3. The OpenClaw browser CLI remains reachable.
  4. Following the Skill, the Agent checks browser status and then stops the openclaw browser profile without requesting explicit user approval.
  5. Existing browser activity in that profile is terminated or interrupted.
  6. The Agent starts the profile again and open ...[truncated 852 chars]
Remediation
View remediation

Remediation Suggestions

  1. Require explicit user confirmation before executing openclaw browser ... stop.
  2. Report which browser profile will be affected and warn that unrelated active work may be interrupted.
  3. Prefer non-destructive recovery first, such as checking status, opening RemNote in a new tab, invoking a reconnect action, or waiting for the bridge retry interval.
  4. Stop the browser only after evidence shows that a restart is necessary.
  5. Use a dedicated RemNote browser profile so recovery cannot disrupt unrelated browsing.
  6. Check for active pages or automation tasks before restarting and abort when unrelated activity is detected.
  7. Separate read-only status inspection from state-changing recovery operations in the policy.
  8. Apply a general confirmation gate to host-side state-changing commands, not only to RemNote content mutations.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The failure-handling section instructs the agent to go beyond RemNote note operations and manage auxiliary services and browser state, including starting remnote-mcp-server and controlling an OpenClaw browser profile. This expands the skill's effective authority and creates a broader attack surface where a note-management request can trigger unrelated system actions, increasing the risk of unintended side effects or abuse.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill includes browser lifecycle control commands (openclaw browser ... stop/start/open) that are not necessary for ordinary note search/read/write operations. If invoked automatically during failure recovery, these commands could disrupt existing browser sessions, alter user state, or be repurposed to navigate the managed browser unexpectedly, making the skill more dangerous than its stated purpose suggests.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.