Sumo Smart Note

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:09 AM UTC
• Version: 1.0.0

Overview

This note-taking skill does what it says, but it automatically copies development notes and conversation content into an outside shared notebook path without a separate confirmation step.

Install only if you intend notes to be saved both in workspace memory and in the SumoNoteBook raw/shared folder. Avoid using it for secrets, credentials, proprietary discussions, or private conversation text unless you are comfortable with that shared location retaining the content.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill describes file read/write behavior and access to environment-backed local paths but does not declare any explicit tool scope or permissions. This creates a mismatch between documented behavior and authorization boundaries, making it easier for an agent runtime to grant broader-than-necessary capabilities or for reviewers to miss that the skill writes to local and shared storage.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The description says the skill automatically saves notes to both the workspace and SumoNoteBook, but it does not clearly warn users that one destination is a shared path. This weak transparency increases the risk that users disclose development details, secrets, or private conversation content without understanding that the data will be duplicated into broader-access storage.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The trigger phrases are common conversational expressions like '記下來' and '寫下來', which can easily appear in ordinary dialogue without the user intending a persistent write or sync. Because this skill stores content in multiple locations, broad triggers raise the chance of accidental activation and unintended recording of sensitive information.

Ssd 3

Medium

• Confidence: 98% confidence
• Finding: This section explicitly instructs the agent to record conversation content, development process, problems, and solutions, then sync them into a shared storage path. In context, that creates a natural-language exfiltration channel where secrets, internal code details, credentials, or proprietary discussion may be persistently copied to a broader audience or less-controlled repository.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The example normalizes automatic copying of user statements into shared storage using an ordinary note-taking request. That makes the risky behavior feel routine and lowers the chance that users recognize they are publishing potentially sensitive material beyond the local workspace.

Tainted flow: 'filepath' from os.environ.get (line 45, credential/environment) → open (file write)

Medium

• Category: Data Flow

Content

else:
        new_content = content
    
    with open(filepath, 'w', encoding='utf-8') as f:
        f.write(new_content)
    
    print(f"[OK] Saved to workspace: {filepath}")

• Confidence: 65% confidence
• Finding: Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Tainted flow: 'filepath' from os.environ.get (line 45, credential/environment) → open (file write)

Medium

• Category: Data Flow

Content

else:
        new_content = content
    
    with open(filepath, 'w', encoding='utf-8') as f:
        f.write(new_content)
    
    print(f"[OK] Saved to workspace: {filepath}")

• Confidence: 65% confidence
• Finding: Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill automatically duplicates note content into a second external shared directory with no confirmation, warning, or opt-in control. In a note-taking context, users may record secrets, internal code, credentials, or sensitive project details; silent cross-sync expands data exposure and can leak information beyond the workspace's expected boundary.

Natural-Language Policy Violations

Low

• Confidence: 82% confidence
• Finding: The description and trigger examples are entirely specified in Chinese, including the expected invocation phrase, without indicating any language choice or opt-in. Under the policy, forcing a specific language or locale without user selection can be a natural-language policy issue.

Natural-Language Policy Violations

Low

• Confidence: 96% confidence
• Finding: SQP-3 applies to all file types and covers language or locale policy violations. The file's natural-language interface, usage text, and user-facing messages are written in Chinese only, with no opt-in or explanation that the skill is intended exclusively for a Chinese-language environment.

Static analysis

No suspicious patterns detected.