Security audit

Ima Notes Toolkit

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly matches its notes and knowledge-base purpose, but it ships under-documented debug scripts that can expose account identifiers and private note data.

Review before installing. Use it only if you are comfortable granting access to your IMA notes and knowledge bases. Prefer tightly permissioned credential storage or environment variables, avoid running the bundled notes debug scripts, and treat any logs from those scripts as potentially sensitive.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The script actively searches multiple locations for a client identifier, including environment variables, a user config directory, and a skill-local .env file. For a notes/knowledge-base skill, this credential discovery behavior is not necessary for core functionality and expands access to authentication material beyond least privilege.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The script prints the discovered client identifier value to stdout at several points, including the final resolved value. Even if this is a client ID rather than a secret key, exposing authentication-related material in logs can aid misuse, leak environment structure, and normalize unsafe handling of credentials.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger language is extremely broad, including generic phrases like '帮我记一下' and concepts around personal documents and uploads, which increases the chance the skill activates in situations the user did not intend. Over-broad invocation can cause unnecessary access to notes/knowledge-base data and accidental transmission of user content to the remote API.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger phrase for searching notes is overly broad because it includes the generic term “搜索” without requiring note-specific context. In a multi-skill environment, this can cause the notes skill to activate for unrelated searches and potentially access or reveal private notebook metadata or content when the user did not intend a notes operation.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The phrase “有哪些分类” is ambiguous and can refer to many domains outside notebooks. This broad trigger may invoke the notebook-listing API in situations where the user did not ask to browse private note folders, increasing the risk of unintended access to personal organizational data.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The code reads credential-like data from sensitive sources and outputs it without masking, warning, or access control. This creates an immediate disclosure risk through terminal history, CI logs, telemetry, shell capture tools, or support screenshots.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The script harvests a client identifier from multiple local sources, including a user config directory and a skill-local .env file, without any consent prompt, scope restriction, or disclosure. Even if the value is only a client ID and not a secret token, this is still credential-material handling and establishes a pattern of silently reading local configuration data that may not belong to the current script's explicit trust boundary.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The script transmits user-derived search content together with the client identifier to a remote API endpoint without any user-facing notice, confirmation, or logging controls. In a notes/knowledge-base skill, search terms can be sensitive and may reveal private interests, case names, or internal topics, so silent transmission increases privacy and data-handling risk.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The script prints the client identifier directly to the console, which can leak sensitive operational data into terminal history, CI logs, screen recordings, or shared debugging output. Even if the value is only a client ID, exposing identifiers can aid reconnaissance, misuse of an integration, or accidental disclosure of associated account metadata.

Session Persistence

Medium

Category: Rogue Agent
Content: **方式 A — 配置文件（推荐）：** ```bash mkdir -p ~/.config/ima echo "your_client_id" > ~/.config/ima/client_id echo "your_api_key" > ~/.config/ima/api_key ```
Confidence: 88% confidence
Finding: The setup recommends storing long-lived API credentials in plaintext files under ~/.config/ima, which creates local secret persistence risk if file permissions are weak, the host is shared, or other software can read the files. While common for CLI tools, plaintext credential storage increases the blast radius of local compromise and is more sensitive here because the credentials authorize remote API actions on the user's notes/knowledge base.

Static analysis

No suspicious patterns detected.