Security audit

suji-board

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent local note board, but it can retain pasted and uploaded private content longer than users may expect and includes under-disclosed external update and feedback links.

Install only if you are comfortable with browser-local retention of notes, pasted clipboard content, images, reminders, and uploaded documents. Avoid using it for highly sensitive files on shared devices unless you also know how to clear the site's localStorage and IndexedDB manually. Be aware that Check Update and Feedback leave the purely local model by contacting ClawHub or Google Forms.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The skill is presented as a zero-dependency, pure front-end local note tool, but it performs outbound requests for version checks and opens external update/feedback pages. This creates undisclosed network egress from a tool likely used to store sensitive notes, enabling metadata leakage such as IP address, timing, referrer/context, and user interaction patterns.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The version-check function issues a fetch to an external API that is not necessary for core note taking, image handling, or Word export. In a tool expected to be local-only, this breaks user trust and can leak usage metadata whenever the feature is triggered.

Context-Inappropriate Capability

Low

Confidence: 90% confidence
Finding: Opening an external Google Forms feedback page is not required for the stated document-collection purpose and causes navigation to a third-party service. Even without sending note contents directly, it exposes the user's browser to external tracking and breaks the expectation of a self-contained local tool.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The skill description uses very broad, everyday trigger phrases such as '做个文字收集板/速记工具/剪贴板整理器/资料归档页' and even generic packaging requests like '把一段 HTML 做成可安装的 skill'. This can cause the skill to activate in situations beyond the author's intended scope, leading to overbroad invocation and increased exposure of any downstream risky behavior or content handling in the skill.

Vague Triggers

Medium

Confidence: 96% confidence
Finding: The '何时使用本 skill' section lists activation conditions that are still broad and ambiguous, including common tasks like collecting text, organizing clipboard content, or packaging HTML as a skill. Such vague criteria increase the chance of unintended activation, which is a security concern because users may trigger the skill in contexts where its capabilities are unnecessary or where safer, narrower tools should apply.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: Uploaded documents are persisted in localStorage and IndexedDB, including extracted text and original file blobs, but the UI does not clearly warn users that contents remain stored on the device. For a note and document organizer that may handle sensitive material, silent persistence increases the risk of unintended retention and later exposure to other local scripts, shared-browser users, or forensic recovery.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The global paste handler automatically saves pasted text and images into persistent storage without an explicit warning or confirmation. Users may paste confidential clipboard contents expecting temporary insertion, but the app silently retains them, increasing privacy and data-retention risk.

Static analysis

No suspicious patterns detected.