WizNote

• Outcome: Review
• Latest audit: May 28, 2026 · 10:12 AM UTC
• Version: 2.1.0

Overview

This WizNote connector mostly matches its stated purpose, but it exposes account credentials in documentation and gives broad note-modifying and network-fetching authority with weak guardrails.

Install only if you trust the publisher and need broad WizNote account automation. Replace any example credentials with your own safely stored secrets, rotate any exposed password if it was real, restrict the configured WizNote server to a trusted HTTPS endpoint, and treat delete, share, upload, URL-import, and attachment-download actions as sensitive operations that should be explicitly confirmed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (33)

Tainted flow: 'url' from requests.post (line 555, network input) → requests.get (network output)

Medium

• Category: Data Flow

Content

def _get(self, path, params=None):
        """GET 请求封装"""
        url = f'{self.kb_server}{path}'
        resp = requests.get(url, params=params or {}, headers=self._headers())
        return self._parse_response(resp)

    def _post(self, path, data=None, params=None):

• Confidence: 90% confidence
• Finding: The request URL is built from self.kb_server, which is obtained from the login response and not validated against an allowlist or expected origin. If the auth response or configuration is tampered with, subsequent authenticated GETs can be redirected to an attacker-controlled host, leaking the X-Wiz-Token and enabling SSRF-style outbound access.

Tainted flow: 'url' from requests.post (line 555, network input) → requests.post (network output)

Medium

• Category: Data Flow

Content

def _post(self, path, data=None, params=None):
        """POST 请求封装"""
        url = f'{self.kb_server}{path}'
        resp = requests.post(url, params=params or {}, json=data or {}, headers=self._headers())
        return self._parse_response(resp)

    def _put(self, path, data=None, params=None):

• Confidence: 93% confidence
• Finding: This POST wrapper sends JSON payloads and the X-Wiz-Token to a URL derived from self.kb_server, which comes from network input during authentication. If that value is attacker-influenced, note content, metadata, and bearer-style auth material may be exfiltrated to an arbitrary server.

Tainted flow: 'url' from requests.post (line 555, network input) → requests.put (network output)

Medium

• Category: Data Flow

Content

def _put(self, path, data=None, params=None):
        """PUT 请求封装"""
        url = f'{self.kb_server}{path}'
        resp = requests.put(url, params=params or {}, json=data or {}, headers=self._headers())
        return self._parse_response(resp)

    def _delete(self, path, params=None):

• Confidence: 93% confidence
• Finding: The PUT wrapper reuses an unvalidated server-provided base URL for authenticated state-changing requests. A malicious or compromised upstream could cause updates to be sent to an external endpoint, exposing tokens and private note data while also producing unintended outbound traffic.

Tainted flow: 'url' from requests.post (line 555, network input) → requests.post (network output)

Medium

• Category: Data Flow

Content

'title': title,
            'type': 'collaboration',
        }
        resp = requests.post(url, params=params, json=data, headers={
            'X-Wiz-Token': self.token, 'content-type': 'application/json'
        })
        result = resp.json()

• Confidence: 92% confidence
• Finding: Creating collaboration notes posts sensitive note metadata and the auth token to a URL composed from self.kb_server. Because that server value is learned from login rather than hardcoded or validated, a hostile login response can pivot this client into sending authenticated content to an attacker-controlled service.

Tainted flow: 'url' from requests.post (line 555, network input) → requests.get (network output)

Medium

• Category: Data Flow

Content

def download_attachment(self, doc_guid, att_guid):
        url = f'{self.kb_server}/ks/attachment/download/{self.kb_guid}/{doc_guid}/{att_guid}'
        timeout = (self.ATTACHMENT_CONNECT_TIMEOUT_S, self.ATTACHMENT_READ_TIMEOUT_S)
        resp = requests.get(url, params={'clientType': 'web', 'clientVersion': '4.0'},
                            headers={'X-Wiz-Token': self.token}, stream=True, timeout=timeout)
        if resp.status_code != 200:
            raise Exception(f'下载附件失败: HTTP {resp.status_code}')

• Confidence: 88% confidence
• Finding: Attachment downloads use a URL derived from untrusted kb_server and include the X-Wiz-Token header. If an attacker controls that base URL, they can harvest the token and coerce the agent into making arbitrary outbound requests, which is especially sensitive because attachments may contain private files.

Tainted flow: 'url' from requests.post (line 555, network input) → requests.get (network output)

Medium

• Category: Data Flow

Content

'cookie': f'x-live-editor-token={editor_token}',
            'user-agent': 'Mozilla/5.0'
        }
        resp = requests.get(url, headers=headers, stream=True, timeout=timeout)
        if resp.status_code != 200:
            raise Exception(f'下载协作资源失败: HTTP {resp.status_code}')
        return resp.content

• Confidence: 86% confidence
• Finding: The collaboration resource download fetches from a URL built with untrusted kb_server-derived domain data and sends an editor token in a cookie. That can leak document access credentials to an attacker-controlled host and expose note resources or enable unauthorized document access.

Tainted flow: 'url' from requests.post (line 555, network input) → requests.post (network output)

Medium

• Category: Data Flow

Content

name = name or os.path.basename(file_path)
        url = f'{self.kb_server}/ks/attachment/upload/{self.kb_guid}/{doc_guid}'
        with open(file_path, 'rb') as f:
            resp = requests.post(
                url,
                files={'file': (name, f)},
                headers={'X-Wiz-Token': self.token},

• Confidence: 91% confidence
• Finding: Uploading attachments posts local file contents to a URL derived from self.kb_server with the auth token attached. In an agent context, this is particularly dangerous because a compromised login response could redirect arbitrary local files selected by later tool use to an attacker endpoint.

Tainted flow: 'url' from requests.post (line 555, network input) → requests.get (network output)

Medium

• Category: Data Flow

Content

'cookie': f'x-live-editor-token={editor_token}',
            'user-agent': 'Mozilla/5.0'
        }
        resp = requests.get(url, headers=headers, stream=True, timeout=timeout)
        if resp.status_code != 200:
            raise Exception(f'下载协作资源失败: HTTP {resp.status_code}')
        return resp.content

• Confidence: 84% confidence
• Finding: The resource download URL embeds src directly into the path without sanitization or encoding, and src can originate from note content. If an attacker can control collaboration resource references, they may induce requests to unintended paths on the Wiz backend and potentially access other backend resources or trigger unexpected authenticated fetches.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The documentation includes and normalizes use of a plaintext account password in environment configuration, and even shows what appears to be a real credential value. This creates a direct credential exposure risk via source control, logs, screenshots, shell history, or process-environment leakage, and can lead to full account compromise.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The create-note tool accepts an arbitrary user-supplied URL, performs a direct server-side HTTP GET, follows redirects, parses the response, and imports the result into WizNote. This expands the connector from a WizNote API client into a general-purpose network fetcher, creating SSRF-style risk and unintended outbound access to internal or sensitive endpoints if untrusted users can invoke the tool.

Vague Triggers

High

• Confidence: 91% confidence
• Finding: The trigger description is extremely broad, activating on general mentions of WizNote/Wiz or any operation related to the product. In an agent setting this can cause accidental invocation of powerful note-modifying, deletion, sharing, or upload actions when the user may only be discussing the tool rather than authorizing operations.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: Displaying credential fields including a plaintext password without any warning or handling guidance encourages insecure secret management practices. In skill ecosystems, users often copy examples verbatim, so this materially increases the chance of credential leakage and downstream compromise.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill documents destructive and access-changing operations such as deletion, sharing, and attachment upload without warnings, guardrails, or confirmation requirements. In an automated agent context, omission of these safeguards raises the risk of accidental data loss, oversharing, or uploading sensitive local files to remote services.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The server downloads note resources and attachments and writes them to local paths derived from remote metadata such as resource names, without user confirmation. This can unexpectedly persist sensitive data on disk and, because filenames are not sanitized here, may also enable path traversal or overwrite of unintended files if a crafted attachment name contains path separators or traversal sequences.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The tool performs outbound requests to arbitrary URLs and silently turns fetched content into notes, without an explicit warning that network access will occur. In an MCP/agent setting, this can surprise users, leak network metadata, and be abused to contact attacker-controlled or internal endpoints under the server's network identity.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The wrapper exposes a destructive delete command that immediately deletes a note based solely on a GUID, with no confirmation prompt, dry-run mode, or other guardrail. In an agent-driven context, ambiguous user requests, prompt injection, or parameter mix-ups can cause irreversible data loss much more easily than in a purely manual CLI workflow.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: Deleting a category is also a destructive action, and the wrapper performs it immediately without any user-facing warning or confirmation. Depending on backend behavior, this can cause loss of organization or affect many notes at once, making the absence of a safety check particularly risky in an automated skill.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests
websocket-client
python-dotenv
html2text

• Confidence: 95% confidence
• Finding: The dependency list uses an unpinned version for requests, so installations may resolve to different versions over time, including vulnerable or breaking releases. In a skill that performs API/network operations, this increases supply-chain and reliability risk because behavior and security posture can change without review.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests
websocket-client
python-dotenv
html2text
bs4

• Confidence: 95% confidence
• Finding: websocket-client is unpinned, allowing uncontrolled dependency resolution during installation. Because this skill likely communicates over network channels, an unexpected or compromised release could introduce exploitable behavior or break transport security assumptions.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests
websocket-client
python-dotenv
html2text
bs4
certifi

• Confidence: 94% confidence
• Finding: python-dotenv is unpinned, which creates a supply-chain and reproducibility weakness. Although this package is typically lower risk than parsers or network clients, version drift can still pull in vulnerable releases or alter environment-loading behavior unexpectedly.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests
websocket-client
python-dotenv
html2text
bs4
certifi
trafilatura

• Confidence: 93% confidence
• Finding: html2text is unpinned, so deployments may consume different versions with different security characteristics. In a skill that processes note content, uncontrolled parser/converter versions can increase risk from malformed or adversarial input.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

websocket-client
python-dotenv
html2text
bs4
certifi
trafilatura
markdown

• Confidence: 93% confidence
• Finding: bs4 is unpinned, which weakens reproducibility and can expose the skill to newly introduced bugs or known vulnerable releases. Since this skill may parse user-controlled content, parser-library version drift is a meaningful security concern.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

python-dotenv
html2text
bs4
certifi
trafilatura
markdown
pypdf

• Confidence: 94% confidence
• Finding: certifi is unpinned, so trust-store behavior can change unexpectedly across installations. In a connector skill that likely makes HTTPS requests, certificate bundle changes can affect TLS validation and trust decisions, making this more security-relevant than a generic utility dependency.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

html2text
bs4
certifi
trafilatura
markdown
pypdf
pytesseract

• Confidence: 94% confidence
• Finding: trafilatura is unpinned, allowing dependency resolution to vary and potentially include vulnerable parser behavior. Because this package processes external content, malformed inputs could trigger parser bugs, denial of service, or unsafe handling in some versions.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

bs4
certifi
trafilatura
markdown
pypdf
pytesseract
pillow

• Confidence: 95% confidence
• Finding: markdown is unpinned, which is risky because content-rendering libraries often process attacker-controlled text and may have parsing vulnerabilities. In a note-taking integration, user-supplied Markdown is plausible input, so version drift can materially increase exploitability.

Static analysis

No suspicious patterns detected.