Security audit

笔记同步CLI(专业版)

Security checks across malware telemetry and agentic risk

Overview

This notes-management skill is mostly coherent, but it asks for broad file and shell authority while enabling deletion, Git sync, and LLM processing with unclear scope and inconsistent data-flow disclosure.

Review this skill carefully before installing. Use it only for explicit note-vault tasks, keep Git sync and LLM features disabled unless you intend to send notes to a remote repository or external API, and require dry-run plus explicit confirmation before delete, cleanup, push, sync, or apply commands.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The skill is presented as a notes-management CLI, but the description also says it should be used when AI model invocation, intelligent dialogue, agent orchestration, and LLM applications are needed. That scope expansion can cause agents to invoke the skill outside its real safety boundary, increasing the chance of unintended file, shell, network, or sync actions under an over-broad mandate.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The document claims all data is stored locally and that no cloud storage is provided, yet other sections require remote Git synchronization and external LLM APIs. This inconsistency can mislead users and agents about data egress, causing sensitive notes or metadata to be transmitted off-device without fully informed consent.

Vague Triggers

High

Confidence: 96% confidence
Finding: The invocation guidance is overly broad, effectively authorizing use whenever AI models, dialogue, agent orchestration, or LLM apps are involved. In an agent environment with Read/Write/Edit/Bash available, such broad routing increases the risk that unrelated user requests trigger destructive note operations, Git actions, or networked LLM/sync behaviors.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The setup and feature descriptions enable Git auto-commit, push/sync behavior, and LLM-based processing without prominent up-front warnings about remote side effects on user data. Users may not realize that enabling these features can create persistent history, transmit content to remotes, or expose note metadata/content to external services.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill documents destructive batch operations such as bulk delete and later cleanup commands without strong warnings, guardrails, or mandatory preview steps. In an agent context, a mistaken filter or misrouted request could delete large numbers of notes or purge data with little friction.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.