Security audit

Bear Share Sync

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does what it says, but it can automatically send Bear note excerpts to iMessage and has polling bugs that could resend or mishandle note content.

Review before installing or scheduling. Use this only for notes you intentionally want shared outside Bear, verify BEAR_SHARE_TARGET carefully, avoid sensitive #share notes, and fix the polling script's JSON handling and processed-note condition before enabling cron or one-shot automation.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The skill claims to detect newly tagged Bear notes, but it also reads, packages, and outputs the full note content while maintaining persistent processing state. This expands data access beyond the stated purpose and can expose sensitive note bodies to downstream consumers or logs without clear necessity.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The script emits full note bodies even though its declared purpose is only to identify new notes tagged for sharing. Because Bear notes may contain sensitive personal or business information, exposing content unnecessarily increases the risk of unintended disclosure through other agents, logs, or integrations.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The preview step sends the first 280 characters of note content to an external iMessage/BlueBubbles target, but the skill description does not prominently warn that user-authored content leaves the local Bear environment. This creates a privacy and confidentiality risk, especially if notes contain sensitive personal, business, or credential-adjacent information.

Missing User Warnings

Low

Confidence: 87% confidence
Finding: The skill creates or updates persistent files on disk, including the canvas and state file, without clearly warning users about those side effects in the description. Hidden persistence is less severe than exfiltration, but it still affects system integrity, auditability, and user expectations around data retention.

Ssd 3

Medium

Confidence: 90% confidence
Finding: The skill is explicitly designed to distribute content derived from Bear notes to an external messaging channel, which is a real data-sharing capability with confidentiality implications. In context, this appears intentional product behavior rather than malicious exfiltration, but it is still dangerous if used on notes containing sensitive information or if the target is misconfigured.

Ssd 3

Medium

Confidence: 94% confidence
Finding: Sending the first 280 characters of each note can expose secrets, personal data, or confidential context because the beginning of notes often contains summaries, names, or actionable details. The danger is amplified by automation: a simple tagging action can trigger outbound transmission without a review step.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The one-shot pipeline automatically forwards note titles and excerpts for every newly detected shared note, increasing the chance of unintended bulk disclosure and making mistakes hard to catch before transmission. Automation reduces human oversight and can rapidly propagate sensitive content to the wrong recipient if tagging, state handling, or target configuration is incorrect.

Static analysis

No suspicious patterns detected.