Joplin

• Outcome: Review
• Latest audit: Sep 14, 2026 · 10:52 PM UTC
• Version: 0.1.1

Overview

The skill does what it says broadly, but it handles Joplin passwords and destructive note operations in ways users should review carefully before installing.

Install only if you are comfortable giving the skill access to read, search, create, edit, and delete your Joplin notes. Avoid http:// server URLs, do not set JOPLIN_SKIP_TLS_VERIFY unless you understand the interception risk, and do not let the agent print ~/.joplin-server-config. Confirm note IDs and titles before delete or overwrite operations, and consider using 1Password or short-lived environment variables instead of keeping a plaintext password file.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:96

Finding

Plaintext Joplin Credentials May Be Exposed Through Agent Command Output

Content

View full analysis

/dev/null || echo "CONFIG_MISSING" ``` The troubleshooting section repeats the unsafe command: ```bash # SKILL.md:284-285 # Check config file cat ~/.joplin-server-config ``` ### Technical Analysis The `~/.joplin-server-config` file is documented as containing plaintext values for `JOPLIN_SERVER_URL`, `JOPLIN_EMAIL`, and `JOPLIN_PASSWORD`. The Skill also instructs the Agent to execute actual commands and show real results. Consequently, using `cat` for a presence check or troubleshooting operation can copy the complete email and password into tool output, conversation history, execution logs, or platform telemetry. Displaying the secret values is not necessary to determine whether the configuration file exists or whether required fields are present. This behavior therefore exceeds the minimum access required for configuration diagnostics. ### Attack Path 1. A user invokes the Skill for first-time setup or authentication troubleshooting. 2. The Agent follows `SKILL.md` and executes `cat ~/.joplin-server-config`. 3. The shell returns the complete file, including `JOPLIN_EMAIL` and `JOPLIN_PASSWORD`. 4. The plaintext credentials become part of Agent-visible tool output. 5. Any person, integration, logging service, or telemetry system with access to that output may recover the credentials and use them to authenticate to the configured Joplin server. ### Impact Assessment Successful disclosure grants access equivalent to the compromised Joplin account. Depending on the account's server-side permissions, an attacker may be able to read private notes, search note contents, create or alter notes, and delete synchronized content. This issue does not directly gran ...[truncated 203 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/joplin-server-api.js:256

Finding

Authenticated Joplin Traffic Can Use HTTP or Disabled TLS Certificate Validation

Content

View full analysis

{ const fullUrl = new URL(urlPath, this.url); const protocol = fullUrl.protocol === 'https:' ? https : http; // Build cookie header const cookieHeader = Object.entries(this.cookies) .map(([k, v]) => `${k}=${v}`) .join('; '); const reqOptions = { hostname: fullUrl.hostname, port: fullUrl.port || (fullUrl.protocol === 'https:' ? 443 : 80), path: fullUrl.pathname + fullUrl.search, method: method.toUpperCase(), headers: { 'Content-Type': options.contentType || 'application/json', ...(cookieHeader && { 'Cookie': cookieHeader }), ...options.headers }, rejectUnauthorized: !this.skipTlsVerify }; ``` Credentials are subsequently submitted through the same request mechanism: ```javascript // scripts/joplin-server-api.js:350-354 async login() { const res = await this.post('/login', { email: this.email, password: this.password }); return res; } ``` ### Technical Analysis The client selects the native `http` module whenever the configured URL is not HTTPS. It does not reject an `http://` Joplin server URL before sending authentication credentials, session cookies, note contents, and modifications. For HTTPS connections, the `JOPLIN_SKIP_TLS_VERIFY` option sets `rej ...[truncated 2178 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (16)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The description is only partially accurate. The core Joplin Server note/notebook management and search behavior matches, but there are material discrepancies. The code includes undeclared capabilities for tags and note-tag relationships, plus sync lock management through /api/locks. Conversely, the declared support for kanban boards is not present anywhere in the code, and todo support is limited to optional note serialization fields rather than explicit todo operations. Because the declared description both omits real capabilities and claims capabilities not actually implemented, this is a mismatch.

Content

No source excerpt is available for this finding.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 75% confidence

Finding

The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The markdown advertises create, edit, and delete operations for notes, but it does not warn users that deletion can permanently remove or alter their data. Under the markdown-file criteria for SQP-2, skills that can affect user data should disclose those risks so users understand the consequences before use.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 20)May include surrounding context.

md

## Features

- Create, read, update, and delete notes
- Create and manage notebooks
- Search notes by title or content
- Automatic sync lock handling (prevents conflicts with other Joplin clients)
- Support for markdown notes and TODO items

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 95)May include surrounding context.

md

- "Create a new note called 'Meeting Notes' in my Work notebook"
- "Search for notes about project planning"
- "Show me my TODO for today"
- "Add a task to my daily TODO"

## Available Commands

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 118)May include surrounding context.

md

- Authentication and session management
- Joplin's item serialization format
- Sync lock protocol (acquire/release locks for write operations)

## Security

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 122)May include surrounding context.

md

## Security

- Credentials are stored locally in `~/.joplin-server-config` (with `chmod 600` permissions)
- With 1Password integration, secrets are fetched from 1Password and written to the config file
- TLS certificate validation is enabled by default; set `JOPLIN_SKIP_TLS_VERIFY=true` only for self-signed certificates
- All communication with your Joplin Server uses HTTPS

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 81% confidence

Finding

The skill encourages creating a persistent credential file in the user's home directory and operationally depends on reusing it across sessions. In an agent environment, persistent auth material broadens the window for misuse or unintended access beyond the immediate task, especially if future commands or users on the system can read or leverage that file.

Content

Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.

md

1. **Always run the actual commands** using the Bash tool
2. **Check for errors** in JSON responses - report any errors to the user
3. **Show real data** from the API responses
4. If config is missing, offer to retrieve from 1Password or create manually

## Setup

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill instructs writing server URL, email, and password into a persistent local config file but does not clearly warn that these credentials will remain stored on disk. This can expose secrets to other local processes, backups, shell-history-adjacent handling mistakes, or later unintended disclosure if the file is inspected or copied.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 59)May include surrounding context.

JOPLIN_EMAIL=$JOPLIN_EMAIL JOPLIN_PASSWORD=$JOPLIN_PASS EOF chmod 600 ~/.joplin-server-config

text

Ask user for their 1Password vault name and item name if different from "Private/Joplin Server".

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

JOPLIN_EMAIL=$JOPLIN_EMAIL JOPLIN_PASSWORD=$JOPLIN_PASS EOF chmod 600 ~/.joplin-server-config

text

Ask user for their 1Password vault name and item name if different from "Private/Joplin Server".

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 114)May include surrounding context.

JOPLIN_EMAIL=$JOPLIN_EMAIL JOPLIN_PASSWORD=$JOPLIN_PASS EOF chmod 600 ~/.joplin-server-config

text

Ask user for their 1Password vault name and item name if different from "Private/Joplin Server".

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill documents a destructive delete operation without requiring confirmation, warning about permanence, or encouraging a preview step. In an agent context, this increases the chance of accidental data loss if a user request is ambiguous or the wrong note ID is supplied.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This code reads JOPLIN_EMAIL and JOPLIN_PASSWORD from environment variables and later transmits them to the server during login, but there is no user-facing prompt, warning, or explanatory comment near the operation indicating that credentials will be used and sent over the network. For a code file, sensitive credential access and network transmission should have some visible disclosure unless clearly surfaced elsewhere in the skill description, which is not present in this file.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest description says the skill manages notes, notebooks, todos, and kanban boards. In the code, the actual high-level operations are limited to notes, notebooks, tags, note-tag links, item listing, and text search; there are no dedicated kanban APIs and no explicit todo management surface beyond optional todo fields during note serialization.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The deleteNote method performs a remote deletion of note data, and the CLI exposes it directly through the delete-note command without any confirmation prompt or cautionary disclosure. Although deletion is part of the command's purpose, this file provides no warning text in the command help or inline logging that the action is irreversible or affects stored user data.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.