Bear Share Sync

• Analyzed: May 11, 2026, 7:21 PM
• Findings: 1
• Version: 4.1.0
• Hash: ddb5fb2f3e9c33b9a1c6f186efd2b63b3e2f7966c01d3bb903caff471022ec3d
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill contains a significant command injection vulnerability in scripts/poll-share-notes.sh and the SKILL.md pipeline example. Raw note content from the Bear app is injected directly into Python command strings using shell variables (e.g., '''$RAW'''), which allows for arbitrary code execution if a note contains triple quotes or malicious Python code. While the stated purpose of syncing notes to a JSON Canvas and BlueBubbles iMessage is plausible, the lack of input sanitization on external data sources poses a high security risk.