笔记记录器基础版

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:38 AM UTC
• Version: 1.0.1

Overview

The skill is a mostly ordinary local note/task manager, but it asks for unnecessary credential-related environment checks and under-discloses optional network/API/callback behavior.

Review this skill before installing. Use it only if you are comfortable with an agent running local note-taker commands and writing task/export files, and avoid running the documented broad environment-variable checks. Treat callback_url, external API, and API key features as under-specified unless the publisher clarifies exactly what data leaves the machine.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:185

Finding

Sensitive Environment Variable Enumeration

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 185–187
Vulnerability Type: Sensitive environment-variable enumeration beyond legitimate task requirements
Risk Level: Medium

Vulnerable Code

bash

# Verify whether environment variables are configured
echo "Configuration check:"
env | grep -E "API|KEY|TOKEN|SECRET" | sed "s/=.*/=***/"  # Linux/macOS
# Or PowerShell
# Get-ChildItem Env: | Where-Object {$_.Name -match "API|KEY|TOKEN"} | Format-Table

Technical Analysis

The skill asks the Agent to inspect all environment variables whose names contain API, KEY, TOKEN, or SECRET. This is unrelated to the stated note-management functionality and violates least-privilege principles. Verifying the note-taker configuration only requires checking the documented NOTE_TAKER_DIR variable.

The Unix command masks values after enumeration, but still exposes sensitive variable names and reveals which services or credential types are configured. The PowerShell alternative is more dangerous because Get-ChildItem Env: returns both names and values; filtering and formatting do not redact those values. Consequently, API keys and authentication tokens may be printed directly.

Because the instructions are intended to drive an AI Agent with execution capability, command output may also enter Agent context, terminal logs, transcripts, or other retained execution records.

Attack Path

1. A user loads the skill and follows its configuration-verification instructions.
2. The AI Agent invokes the documented command through its execution tool.
3. The command enumerates unrelated credential-bearing environment variables.
4. On Linux or macOS, credential names and configured services are disclosed, although values are masked.
5. On PowerShell, matching environment-variable names and their complete values may be displayed.
6. The sensitive output may be exposed to the user, retained in logs or conversation history, or become available to s ...[truncated 712 chars]

Remediation

View remediation

Remediation Suggestions

Remove broad environment enumeration and verify only the specific setting required by the skill.

For Linux and macOS, use a targeted presence check that does not print the value:

bash

if [ -n "${NOTE_TAKER_DIR:-}" ]; then
  echo "NOTE_TAKER_DIR is configured"
else
  echo "NOTE_TAKER_DIR is not configured; the default directory will be used"
fi

For PowerShell, use:

powershell

if (Test-Path Env:NOTE_TAKER_DIR) {
    Write-Output "NOTE_TAKER_DIR is configured"
} else {
    Write-Output "NOTE_TAKER_DIR is not configured; the default directory will be used"
}

Additional hardening measures:

1. Do not enumerate variables matching broad credential-related terms.
2. Never print credential values as part of configuration diagnostics.
3. Limit execution instructions to resources strictly required for note management.
4. Ensure Agent and terminal logs redact secrets as defense in depth.
5. Document each environment variable the skill requires and validate only those explicitly named variables.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation makes a strong privacy assurance that data is only stored locally and not uploaded, yet elsewhere it permits network/API use and callback URLs for remote notifications. This mismatch can mislead users and agents into exposing task content, metadata, or backups to external systems under false assumptions of local-only handling.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The version matrix states '批量操作: 不支持' for FREE at L47, presenting a limited single-item scope. However, repeated capability text says the same input supports '创建/查询/导出操作' (L61, L68, also later sections), which expands behavior beyond the narrowly described per-task core actions and conflicts with the stated FREE limitations and feature framing.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The skill advertises export and exec-driven operations but does not clearly warn that these actions can modify local data, write files, or invoke shell commands with real side effects. In an agent environment, missing safety boundaries can turn ordinary natural-language requests into unintended command execution or silent data exposure through exported artifacts.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger conditions are inconsistent with the skill's purpose and broad enough to activate the skill for loosely related tasks such as analytics, reporting, or visualization. In an agent setting, ambiguous invocation criteria can cause the wrong skill to run, leading to unintended file access, command execution, data export, or network use outside the user's actual intent.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

A basic local note/task manager should not need broad credential handling, external API connectivity, or generic network capability unless narrowly justified. Including these capabilities expands attack surface and increases the risk of unnecessary secret exposure, data exfiltration, or agent overreach beyond the user's expected local workflow.

Content

No source excerpt is available for this finding.