Security audit

笔记工具包基础版

Security checks across malware telemetry and agentic risk

Overview

The skill appears to be a note-management helper, but its privacy and execution boundaries are unclear enough that users should review it before installing.

Install only if you are comfortable with an agent using local read/search/command tools for your notes. Treat the local-only privacy claims as unreliable unless the publisher clarifies which features call external APIs, what note content or metadata can be sent, how callback URLs are used, and when commands require confirmation.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The manifest and summary repeatedly claim 'pure local storage' and privacy protection, but later sections explicitly require network connectivity and external APIs for some functionality. This creates a misleading trust boundary: users may expose note content or metadata to remote services under the false belief that nothing leaves the machine.

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: The FAQ says data is never uploaded to the cloud, yet the dependency and API-key sections state that some functions use external APIs and network access. This contradiction can cause users to supply sensitive notes, meeting prep content, or personal knowledge data to remote services without informed consent, making the issue more serious than a mere documentation error.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The trigger condition says to use the skill for broad data analysis, reporting, statistics, and visualization needs, which does not match a note-management tool. Overbroad or mismatched activation criteria increase the chance an agent invokes this exec-enabled skill in inappropriate contexts, potentially causing unintended local command execution or file access.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The instruction to describe needs in natural language and let the agent automatically execute corresponding operations is too open-ended for a skill with read/exec/glob/grep capabilities. Without precise trigger constraints, user text can be over-interpreted into local command execution, increasing the risk of unsafe actions on files or environment data.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill advertises natural-language automation and compatible agent execution, but does not clearly warn that examples may invoke local commands through exec. In this context, the omission is dangerous because users may not realize the skill can read files, inspect environment state, or run commands that affect local data.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.