Note Process Engine Free

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:33 AM UTC
• Version: 1.0.0

Overview

The skill mostly describes a local note-analysis helper, but its read-only promise conflicts with instructions that mention create, modify, import, export, save, and broad activation.

Install only if you intend to use it for local research-note analysis and can keep the agent constrained to explicit read-only commands against a chosen JSON database. Avoid using the generic create/modify/import/export/save instructions unless the publisher clarifies side effects, and install optional jieba only in a dedicated environment with a reviewed pinned version.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:347

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 347
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code

markdown

| jieba | Python library | Optional | `pip install jieba` (for Chinese word segmentation) |

Technical Analysis

The documentation instructs users or an AI agent to install jieba without specifying a reviewed version, verifying package hashes, using a lockfile, or identifying a trusted package index. The installed artifact can therefore change over time without any corresponding change to the audited Skill.

Although the dependency is optional, users who want Chinese word segmentation may follow this instruction. Python package installation can execute package-controlled build or installation logic. Consequently, compromise of the package, its distribution account, the configured package index, or the dependency-resolution path could turn this instruction into arbitrary local code execution.

The project does not contain the advertised Python implementation, so the dependency's runtime use could not be verified. No evidence was found that the Skill intentionally selects a malicious or typosquatted package.

Attack Path

1. A user or AI agent enables the documented Chinese word-segmentation capability.
2. It runs pip install jieba as instructed.
3. pip resolves the current package from the environment's configured index without a version or integrity constraint.
4. If the selected distribution or package source has been compromised, attacker-controlled installation or package code executes.
5. The code runs with the privileges and environment access of the account invoking pip or subsequently importing the package.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the invoking user's privileges. The attacker could access files, environment variables, note databases, and network resources available to that account ...[truncated 382 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin jieba to a reviewed, exact version rather than resolving the latest release.
2. Record cryptographic hashes in a dependency lock or requirements file and install with hash enforcement:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

3. Explicitly use a trusted package index and ensure TLS certificate verification remains enabled.
4. Recommend installation inside a dedicated virtual environment under a non-privileged account:

   bash

   python -m venv .venv
   .venv/bin/python -m pip install --require-hashes -r requirements.txt
   

5. Review and update the pinned dependency through a controlled process that includes provenance, vulnerability, and integrity checks.
6. Include the actual analysis script and dependency manifest in the audited package so its imports and runtime behavior can be verified.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest and overview frame the free edition as a read-only note analysis tool, but the operational sections broaden the interface to include creation, modification, import, and export behaviors. In an agent setting, this kind of privilege/behavior drift is dangerous because the documented contract no longer matches the actions the agent may attempt with read and exec tools.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly states that all operations are read-only, but later documents create, modify, import, save, and export style operations. This mismatch can cause an agent or user to authorize the skill under false assumptions, increasing the risk of unintended data changes or exfiltration when exec-enabled workflows are used.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill describes export, save, modify, reset, and import style actions without clear warnings about data effects, while earlier claiming read-only behavior. In combination with exec access, this can lead users or the agent to perform state-changing or data-moving operations without informed consent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger conditions are very broad and can activate the skill for generic requests like analysis, reporting, statistics, or visualization, including contexts outside its stated scope. Over-broad activation is risky because it can cause an exec-capable skill to be selected unnecessarily, exposing user data or enabling unintended command execution paths.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The display name, summary, and nearly all user-facing instructions are presented only in Chinese, with no explicit opt-in or language-selection guidance. Under the stated policy, forcing a specific language without user choice can be a natural-language policy issue unless clearly documented and justified.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

L047 states the free version is '完全基于Python标准库,零外部依赖', and L350 says no external API key is needed. But L345 lists 'LLM API' as required, and L347/L304 mention optional jieba installation for Chinese tokenization. These documentation elements conflict about whether the skill truly has no external/runtime dependencies.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The coverage line enumerates many fragmented keywords such as '核心能力' and broad phrases about analysis and insight, but does not define clear activation boundaries or exclusions. As written, it could be interpreted as matching a wide range of ordinary note, analysis, or productivity requests.

Content

No source excerpt is available for this finding.