vortex-notes

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:42 AM UTC
• Version: 1.0.0

Overview

This skill appears to do what it says: manage a local notes vault, with ordinary caution for persistent notes and its external npm tool.

Install this only if you trust the vortex-notes npm package and are comfortable giving it access to your configured notes vault. Prefer read-only mode for searches, use explicit note-related requests before writes, and avoid storing highly sensitive secrets in the vault unless your local environment is appropriately protected.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:8

Finding

Unpinned Executable npm Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 8–11
Vulnerability Type: Unpinned third-party executable dependency
Risk Level: Medium

Vulnerable Code

json

"requires": { "bins": ["vortex-notes"] },
"install":
  [{ "id": "npm", "kind": "npm", "package": "vortex-notes", "bins": ["vortex-notes"] }],

The installed binary is subsequently invoked by instructions including:

sh

vortex-notes search "<query>" --vault <vault>

The Skill also proposes starting it as an MCP server:

sh

vortex-notes mcp --vault <vault>

Technical Analysis

The installation metadata identifies vortex-notes only by its npm package name. It does not specify an exact version, integrity hash, lockfile, trusted repository commit, or other immutable provenance information. Installation can therefore resolve to a mutable package release whose implementation was not included in the audited project.

Because the dependency provides an executable, its installation scripts and runtime behavior execute with the permissions of the agent user. The audited project contains no source code for that dependency, so its effective behavior cannot be statically verified from this artifact.

This is a supply-chain weakness rather than evidence that the current package is malicious. The risk arises if the npm package, maintainer account, publication process, or dependency chain is compromised or if a future release introduces unsafe behavior.

Attack Path

1. An attacker compromises the vortex-notes npm package, its publisher account, or a transitive dependency, or publishes an unsafe later release.
2. The Skill installer resolves the unpinned package name to the attacker-controlled or unsafe version.
3. Package installation scripts may execute during installation with the agent user's privileges.
4. The agent follows the Skill instructions and invokes vortex-notes search or starts vortex-notes mcp.
5. The compromised executable run ...[truncated 826 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin vortex-notes to a reviewed, exact version rather than resolving a mutable latest release.
2. Verify the package with a lockfile and registry integrity hash, and enforce immutable or reproducible installation.
3. Document and validate package provenance, including its official repository, publisher identity, release signature, and source-to-package correspondence.
4. Audit the package source, lifecycle scripts, and transitive dependency tree before approval.
5. Disable npm lifecycle scripts during installation unless they are explicitly required and reviewed.
6. Execute the binary in a sandbox with filesystem access restricted to the selected vault and with network access disabled unless necessary.
7. Use the documented --read-only mode whenever write access is not required.
8. Apply least-privilege permissions to the vault and avoid exposing unrelated user files or credentials to the process.
9. Consider vendoring the reviewed implementation or obtaining it from a controlled internal package registry.

SkillSpector

Vulnerability Patterns

• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

md

(or `memory/<topic>.md`) as `- **YYYY-MM-DD** <fact> \`^f-<8 random chars>\``.
  If the fact REPLACES an earlier one, strike the old line through
  (`- ~~old line~~ → superseded YYYY-MM-DD by \`^f-new\``) and keep it —
  never delete history.
- **New notes**: create `<kebab-case-title>.md` (optionally in a folder) with
  frontmatter `title:` and `created:`/`updated:` ISO timestamps.
- **Edits**: edit surgically (append a section, fix a line). Never rewrite a

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill description includes broad trigger phrases such as 'note this down', 'remember that…', and 'what do my notes say about…', which are common in everyday conversation and could cause the agent to invoke this skill when the user did not intend persistent note access or writes. In a skill that can both read from and write to a personal knowledge vault, accidental invocation increases the risk of unintended data disclosure or unwanted persistence of user statements.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.