笔记CLI工具箱

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:19 AM UTC
• Version: 1.0.2

Overview

This notes automation skill is not malicious, but it asks agents to run commands and modify note vault files in bulk while its scope, safeguards, and dependency handling are not tight enough for automatic trust.

Review this skill before installing. Use it only on backed-up or version-controlled Obsidian vaults, prefer dry-run and explicit file lists before any batch edit, pin notesmd-cli in CI, restrict Git tokens to the minimum required permissions, and avoid enabling it for general data-analysis requests unrelated to notes.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:80

Finding

Unpinned Global npm Dependency in CI Workflow

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:80
Vulnerability Type: Supply-chain exposure through an unpinned third-party dependency
Risk Level: Medium

yaml

      - run: npm install -g notesmd-cli

Technical Analysis

The documented CI workflow globally installs the current registry version of notesmd-cli without pinning an exact version or enforcing an integrity-checked lockfile. Consequently, the code executed by the workflow can change after the Skill has been reviewed.

npm package installation can also execute package lifecycle scripts with the CI runner's permissions. If the package, one of its dependencies, its maintainer account, or the package registry distribution channel is compromised, a future workflow run could execute altered code. No evidence establishes that notesmd-cli is currently malicious; the issue is the unsafe dependency acquisition model.

Attack Path

1. An attacker compromises the package's publishing account, registry artifact, or transitive dependency.
2. The attacker publishes a malicious version under the package version range selected by the unpinned install.
3. A scheduled or manually triggered CI workflow runs npm install -g notesmd-cli.
4. npm retrieves the altered release and may execute its lifecycle scripts.
5. The installed package subsequently runs against the checked-out repository and Obsidian vault.
6. Malicious code operates with the permissions and environment available to the CI job.

Impact Assessment

Successful exploitation could provide code execution under the CI runner identity. Depending on workflow configuration, exposed resources may include repository files, writable vault contents, environment variables, and credentials made available to the job. A writable repository token could permit unauthorized commit or content modification within that token's scope. The finding does not demonstrate privilege escalation beyond the runner' ...[truncated 23 chars]

Remediation

View remediation

Remediation Suggestions

• Pin notesmd-cli to an audited exact version instead of selecting the latest release.
• Prefer a project-local dependency recorded in package.json and a committed lockfile.
• Use npm ci so dependency resolution follows the lockfile exactly.
• Review package provenance, lifecycle scripts, and transitive dependencies before adoption.
• Use npm integrity and provenance verification where supported.
• Configure the workflow token with minimal permissions, such as read-only contents unless a push is required.
• Separate dependency installation from credential-bearing steps where practical.
• Use dependency monitoring and explicitly review version upgrades.

A safer pattern is:

yaml

      - run: npm ci
      - run: npx --no-install notesmd-cli daily

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:118

Finding

Unsafe Shell Word Splitting During Destructive Batch Editing

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:118-120
Vulnerability Type: Unsafe parsing of filenames returned through command substitution
Risk Level: Medium

bash

for note in $(notesmd-cli search-content "status: draft" --paths-only); do
  notesmd-cli frontmatter "$note" --edit --key "status" --value "published"
done

Technical Analysis

The loop captures path output with command substitution and then allows the shell to perform word splitting and pathname expansion before assigning each value to note. Quoting "$note" inside the loop occurs too late to preserve the original path boundaries.

A note path containing spaces or tabs will be split into multiple iterations. Wildcard characters may expand to unrelated filesystem entries, and newline-containing names cannot be represented safely by this interface. Because each resulting value is passed to a metadata-editing command, malformed parsing can cause unintended files to be selected or expected files to be skipped.

This is not direct shell-command injection because the expanded values are quoted when passed to notesmd-cli; however, it is an unsafe filename-handling flaw in a destructive batch operation.

Attack Path

1. A vault contains a matching draft note whose path includes whitespace or shell glob characters, whether created normally or by an untrusted contributor.
2. notesmd-cli search-content ... --paths-only emits that path.
3. The shell performs word splitting and, where applicable, pathname expansion on the command-substitution result.
4. The loop receives fragments or expanded paths rather than the exact original path.
5. notesmd-cli frontmatter is invoked on unintended path values.
6. The batch operation may modify unrelated notes, fail partially, or leave inconsistent metadata.

Impact Assessment

Exploitation affects files accessible to the user or automation account running the Skill. It may cause unauthori ...[truncated 260 chars]

Remediation

View remediation

Remediation Suggestions

• Use a NUL-delimited path interface if notesmd-cli supports one.
• Disable pathname expansion where legacy text parsing is unavoidable, but do not treat this as a substitute for unambiguous delimiters.
• Prefer structured output such as JSON and parse it with a dedicated parser.
• Add a dry-run phase that displays exact target paths and requires confirmation before mutation.
• Back up or version-control the vault before batch changes.
• Test paths containing spaces, tabs, wildcard characters, leading dashes, and Unicode characters.

If NUL-delimited output is supported, use:

bash

notesmd-cli search-content "status: draft" --paths-only --null |
  while IFS= read -r -d '' note; do
    notesmd-cli frontmatter "$note" \
      --edit --key "status" --value "published"
  done

If NUL-delimited output is unavailable, update the CLI or use a verified structured-output mode rather than parsing whitespace-separated paths.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 248)May include surrounding context.

md

| LLM API | API | 必需 | 由 Agent 内置 LLM 提供 |
### API Key 配置
- 无需 API Key
- CI 集成需要 Git 仓库的 Personal Access Token（用于 push）
### 可用性分类
- **分类**: MD+EXEC（Markdown 指令 + 必须通过 exec 执行 `notesmd-cli` 与批量脚本）
- **说明**: 基于自然语言指令驱动 Agent 批处理笔记，含无头模式、frontmatter 治理、daily 模板化

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The description says to use the skill whenever data analysis, reporting, statistics, or visualization are needed, which is much broader than the actual notes/Obsidian-focused functionality. It does not define specific trigger phrases, contexts, or exclusions beyond one generic non-applicability note, increasing the risk of unintended invocation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The description explicitly states '支持中文交互' while the document otherwise mixes Chinese and English and does not indicate that language is optional or user-selectable. This can be a language-policy issue because it signals a fixed interaction locale without opt-in or alternatives.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill prominently documents direct disk writes, frontmatter edits, and batch state changes without an upfront, clear warning that real vault files will be modified. In an agent setting, this increases the risk of silent mass edits, accidental publication-state changes, or destructive changes to note repositories when a user may expect analysis rather than mutation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill claims command execution is restricted by a whitelist and does not concatenate user input, yet the documented design is explicitly MD+EXEC and driven by natural-language parameters that map into CLI operations. This kind of misleading security claim can cause downstream agents or reviewers to trust unsafe exec behavior and pass user-controlled file paths, note names, filters, or editor-related arguments into shell contexts without sufficient validation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The dependency section says '无需 API Key' except for a Git PAT in CI, but later quick-start and FAQ sections instruct users to configure API keys and say some features require them. That is an active contradiction in the skill documentation about the skill's operational intent and dependencies.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.