ClawHub
Back to skill

Security audit

bear-research-enricher

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says, but it automatically edits private Bear notes and sends note-derived keywords to Giphy without a preview or confirmation step.

Install only if you are comfortable with every note tagged 「待整理」 being read, summarized into search terms, sent to Giphy, appended with remote GIF links, and retagged automatically. Prefer reviewing the script first, backing up notes, using non-sensitive notes, and pinning the grizzly dependency before running it.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/enrich_notes.sh:61
Finding

Private Bear note keywords are disclosed to an external GIF service

Content
View full analysis
= 3: break print(' '.join(unique)) " 2>/dev/null) if [ -z "$KEYWORDS" ]; then echo " No keywords extracted, skipping note." continue fi echo " Keywords: $KEYWORDS" # Search GIFs per keyword and build insert block INSERT_BLOCK="" for KW in $KEYWORDS; do echo " Searching GIF for: $KW" ENCODED_KW=$(python3 -c "import urllib.parse; print(urllib.parse.qu ...[truncated 2267 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:14
Finding

Mutable upstream dependency is installed without version or integrity pinning

Content
View full analysis
/dev/null; then echo "ERROR: grizzly not found. Install: go install github.com/tylerwince/grizzly/cmd/grizzly@latest" ``` ### Technical Analysis The documentation directs users to install the `grizzly` executable from the mutable `@latest` reference. This provides no guarantee that the installed source is the version reviewed when the Skill was published. The Skill subsequently invokes that executable with a Bear API token file and uses it to read and modify notes. Consequently, a compromised upstream repository, malicious future release, or unexpected dependency change could execute with the user's account privileges and receive access to Bear operations authorized by the token. This is not a `curl | bash` execution path. The audited files do not download shell source and pipe it directly into a shell. The risk instead arises from trusting an unpinned external build source for a security-sensitive local tool. ### Attack Path 1. The upstream repository, release process, maintainer account, or dependency graph is compromised, or a future release introduces malicious behavior. 2. A user follows the documented `go install ...@latest` instruction. 3. Go retrieves and builds the then-current upstream source rather than a fixed reviewed version. 4. The user runs the Skill's batch script. 5. The newly installed executable is invoked with `--token-file "$TOKEN_FILE"` and note identifiers. 6. A compromised executable can access operations permitted by the Bear token and can act with the operating-system privileges of the us ...[truncated 675 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (12)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The script processes note text and transmits derived content to an external service without any warning, review step, or consent gate. In a research-notes context, even short extracted keywords can expose confidential subjects, client names, internal initiatives, or sensitive personal data to a third party.

Content

No source excerpt is available for this finding.

External Script Fetching

High
Category
Supply Chain
Confidence
91% confidence
Finding

The script fetches untrusted remote content from Giphy and inserts returned GIF URLs directly into notes without validating provenance, content suitability, or persistence. This creates a supply-chain and privacy risk: notes will embed third-party media that can later change, break, or expose readers to external tracking when rendered.

Content

Scanner excerpt · scripts/enrich_notes.sh (reported line 107)May include surrounding context.

sh
for KW in $KEYWORDS; do
    echo "  Searching GIF for: $KW"
    ENCODED_KW=$(python3 -c "import urllib.parse; print(urllib.parse.quote('$KW'))")
    GIF_RESULT=$(curl -s "${GIF_API}?api_key=${GIF_KEY}&q=${ENCODED_KW}&limit=3" 2>/dev/null)
    GIF_URL=$(echo "$GIF_RESULT" | python3 -c "
import sys, json
try:

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
97% confidence
Finding

The skill invokes both shell commands and outbound network access but does not declare any tool restrictions or scope boundaries. That makes the skill harder to review safely and increases the chance an agent executes powerful operations without explicit user-visible permissioning, especially because it reads local notes, modifies them, and contacts external services.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The invocation language is broad enough that ordinary user requests about research notes or adding GIFs could trigger the skill unintentionally. Because the skill performs automatic note edits and retagging, accidental activation can cause unintended content modification and external keyword disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill description does not clearly warn that it will append content to notes and change their tags automatically. Users may invoke it expecting analysis only, while it actually performs persistent modifications to local data, which can lead to unwanted edits or workflow disruption.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
98% confidence
Finding

The skill explicitly transmits note-derived search terms to an external Giphy endpoint. In the context of personal research notes, this is a genuine data egress risk because even summarized keywords can leak confidential topics, interests, projects, or regulated subject matter to a third-party service.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

md
2. **For each note**:
   a. Read note content via `grizzly open-note --id <NOTE_ID> --enable-callback --json --token-file ~/.config/grizzly/token`
   b. Extract 2–3 key topics or keywords from the note title and first paragraph.
   c. For each keyword, search GIFs using the gifgrep skill (or `curl "https://api.giphy.com/v1/gifs/search?api_key=dc6zaTOxFJmzC&q=<keyword>&limit=3"` as fallback).
   d. Pick the most relevant GIF URL per keyword.
   e. Append GIFs to the note using `grizzly add-text`:
      ```

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill derives keywords from note contents and sends them to an external GIF service without an explicit privacy warning. Even if only keywords are transmitted, they may reveal sensitive subjects from private research notes, causing unintended data exposure to a third party.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

The hardcoded external API endpoint indicates the skill communicates with a third-party service as part of processing user notes. In this context, the danger is not the mere presence of a URL, but that the endpoint is used to transmit note-derived data outside Bear without clear disclosure.

Content

Scanner excerpt · scripts/enrich_notes.sh (reported line 6)May include surrounding context.

sh
set -euo pipefail

TOKEN_FILE="${GRIZZLY_TOKEN_FILE:-$HOME/.config/grizzly/token}"
GIF_API="https://api.giphy.com/v1/gifs/search"
GIF_KEY="${GIPHY_API_KEY:-dc6zaTOxFJmzCC}"  # public beta key
DELAY=1  # seconds between GIF API calls

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The script derives keywords from note titles and content, then sends them to Giphy's external API. Even though it only transmits extracted keywords rather than full notes, those keywords may still reveal sensitive research topics, projects, names, or confidential themes that were not clearly disclosed to the user.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script appends GIF markdown to notes and retags them automatically with no confirmation or preview. This can corrupt note quality, introduce unwanted remote media, and alter organizational state in bulk, making accidental or inappropriate edits hard to audit or undo.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill changes Bear note tags by adding 已整理 and removing 待整理, which is a state-changing side effect beyond merely enriching notes with GIFs. This can silently alter note workflow and organization, causing users to lose track of unreviewed notes or trigger downstream automations based on tags.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill is hard-coded to operate on the Chinese tags 「待整理」 and 「已整理」, which imposes a specific language/locale convention. The file does not present this as an opt-in choice or explain that the skill is intended only for users who use those tag names.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.