ClawHub
Back to skill

Security audit

bear-research-enricher

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it describes, but it can batch edit tagged Bear notes and send extracted note keywords to Giphy.

Install only if you are comfortable giving the workflow access to Bear via the grizzly token and allowing extracted note topics to be sent to Giphy. Before running it, make sure only intended notes have the 「待整理」 tag and consider backing up important or sensitive notes.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (10)

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill invokes shell commands and makes network requests, but does not declare permissions or clearly signal these capabilities. This increases the chance of unexpected execution in a broader automation context and prevents informed consent about local command execution and outbound connectivity.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The stated purpose suggests note enrichment, but the implementation also changes note tags and sends note-derived keywords to an external API. This mismatch can cause users to authorize the skill without understanding that it alters note state and exposes derived content externally.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The script modifies note workflow state by automatically adding 已整理 and removing 待整理, which goes beyond merely enriching notes with GIFs. This can silently change organizational metadata and cause users or downstream automations to treat notes as reviewed or finalized when they were only decorated.

Context-Inappropriate Capability

Medium
Confidence
98% confidence
Finding
The script derives keywords from note title and content, then transmits those keywords to Giphy. Even though only a subset of the note is sent indirectly, this is still external disclosure of user note content and is not clearly justified as a narrowly local note-enrichment action.

Vague Triggers

Medium
Confidence
82% confidence
Finding
The trigger phrases are broad enough to match common requests like 'research notes' or 'enrich notes,' which could invoke the skill when the user did not intend Bear note modification or GIF insertion. Overbroad activation increases the risk of unintended execution against personal notes.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill description/workflow does not prominently warn that it will automatically modify note bodies and retag notes. Hidden write operations against a personal note store are dangerous because users may expect analysis-only behavior and lose workflow state when tags are changed.

Missing User Warnings

Medium
Confidence
98% confidence
Finding
The workflow transmits note-derived keywords to an external GIF API without an explicit privacy disclosure. Even if only keywords are sent, they may reveal sensitive research topics, project names, or personal interests to a third party.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill sends note-derived keywords to a third-party API without presenting a warning or obtaining consent. Research notes may contain sensitive topics, and leaking even extracted terms can expose confidential projects, personal interests, or proprietary subjects.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The script appends GIF markdown to notes and changes tags automatically, without confirmation or rollback. This can lead to unwanted data modification, note clutter, and accidental workflow transitions that may be hard to audit or undo at scale.

External Transmission

Medium
Category
Data Exfiltration
Content
2. **For each note**:
   a. Read note content via `grizzly open-note --id <NOTE_ID> --enable-callback --json --token-file ~/.config/grizzly/token`
   b. Extract 2–3 key topics or keywords from the note title and first paragraph.
   c. For each keyword, search GIFs using the gifgrep skill (or `curl "https://api.giphy.com/v1/gifs/search?api_key=dc6zaTOxFJmzC&q=<keyword>&limit=3"` as fallback).
   d. Pick the most relevant GIF URL per keyword.
   e. Append GIFs to the note using `grizzly add-text`:
      ```
Confidence
94% confidence
Finding
The skill performs external transmission to Giphy using keywords extracted from Bear notes. In the context of personal research notes, even partial semantic leakage can expose sensitive information beyond the local environment.

Static analysis

No suspicious patterns detected.