Bear Notes

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 4:12 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward Bear notes helper, with manageable cautions around storing a Bear token locally and installing an unpinned third-party CLI.

Before installing, treat the Bear token as sensitive: restrict access to ~/.config/grizzly/token, avoid sharing or backing it up broadly, and consider reviewing or pinning the grizzly CLI version instead of relying on @latest.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:5

Finding

Unpinned Third-Party CLI Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 5
Vulnerability Type: Supply-chain risk caused by a mutable dependency version
Risk Level: Medium

Vulnerable Code Snippet:

yaml

metadata: {"clawdbot":{"emoji":"🐻","os":["darwin"],"requires":{"bins":["grizzly"]},"install":[{"id":"go","kind":"go","module":"github.com/tylerwince/grizzly/cmd/grizzly@latest","bins":["grizzly"],"label":"Install grizzly (go)"}]}}

Technical Analysis

The installation metadata obtains the third-party grizzly executable from github.com/tylerwince/grizzly/cmd/grizzly@latest. The mutable @latest selector does not identify an immutable, reviewed release. Consequently, the code installed in the future can differ from the code that existed when this Skill was audited.

There is no evidence in the reviewed project that the dependency is currently malicious. The vulnerability is the absence of version pinning and integrity verification, which creates a supply-chain exposure if the upstream repository, maintainer account, release process, Go module resolution path, or a future release is compromised.

Attack Path

1. An attacker compromises the upstream project, a maintainer account, or its release process and publishes a malicious version that resolves through @latest.
2. A user installs the Skill requirement after that release becomes current.
3. The installer downloads and builds the changed dependency without enforcing a previously reviewed version or project-specified checksum.
4. The resulting grizzly executable runs with the user's local privileges when Bear-note commands are invoked.
5. Malicious dependency code could read accessible local data, including the configured Bear token, interact with Bear notes, or perform other actions permitted to the user.

Impact Assessment

Successful exploitation would execute upstream-controlled code with the privileges of the user running grizzly. Based on the d ...[truncated 538 chars]

Remediation

View remediation

Remediation Suggestions

• Replace @latest with a specific, reviewed release, such as an exact semantic version.
• Prefer an immutable source revision when supported by the installation framework.
• Verify the dependency using trusted checksums, signed releases, or provenance attestations before installation.
• Establish a controlled dependency-update process that reviews source changes and security advisories before advancing the pinned version.
• Document the approved dependency version and source so unexpected installation changes can be detected.
• Run the executable with only the permissions required to interact with Bear, and restrict access to ~/.config/grizzly/token using owner-only file permissions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The documentation explicitly instructs users to store a Bear API token in a plaintext file under their home directory without any warning about credential sensitivity, file permissions, or safer storage options. While this is a common convenience pattern for CLIs, it increases the risk of credential exposure through overly broad filesystem permissions, backups, local malware, or accidental disclosure.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.