Security audit

SiYuan Note

Security checks for vulnerabilities and agentic risk

Overview

This is a real SiYuan notes client, but it gives an agent broad power to edit or delete notes, run raw database queries, write files, and forward arbitrary web requests without tight safeguards.

Review this skill carefully before installing. Use it only with a trusted local SiYuan instance, keep base_url on localhost, protect config.yaml because it contains the API token, back up notes before write/delete operations, and avoid raw SQL, forward_proxy, file deletion, and --yes unless you explicitly intend that action.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: siyuan_client.py:86
Finding: SiYuan API Token and Sensitive Content Can Be Transmitted to an Arbitrary or Cleartext Endpoint
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: tools/list.py:47
Finding: SQL Injection Through the Notebook Identifier in the Document Listing Tool
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (38)

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The SQL endpoint exposes direct execution of caller-supplied statements against the SiYuan datastore. In an agent-accessible skill, this bypasses higher-level authorization and safety controls, enabling bulk data extraction, metadata discovery, and potentially destructive modification depending on backend enforcement.
Content: No source excerpt is available for this finding.

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · API.md (reported line 1140)May include surrounding context.
md
"code": 0, "msg": "", "data": { "content": "<div data-node-id=\"20220729234848-dlgsah7\" data-node-index=\"1\" data-type=\"NodeParagraph\" class=\"p\" updated=\"20220729234840\"><div contenteditable=\"true\" spellcheck=\"false\">foo</div><div class=\"protyle-attr\" contenteditable=\"false\"></div></div>", "path": "F:\\SiYuan\\data\\templates\\foo.md" } }

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The documented forwardProxy endpoint gives callers a generic outbound HTTP capability that is not constrained to note management. In an agent skill context, this can be abused for SSRF-style access to internal services, exfiltration of local data or tokens via headers/payloads, and bypass of intended network restrictions by tunneling arbitrary requests through the local SiYuan service.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The documented export and backup workflows write note content to the local filesystem, but the skill description does not clearly disclose that local files may be created or overwritten. In practice this expands the impact from API-only note management to host-side data propagation and possible accidental disclosure or overwrite.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The documented export and backup workflows write note content to the local filesystem, but the skill description does not clearly disclose that local files may be created or overwritten. In practice this expands the impact from API-only note management to host-side data propagation and possible accidental disclosure or overwrite.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The documented export and backup workflows write note content to the local filesystem, but the skill description does not clearly disclose that local files may be created or overwritten. In practice this expands the impact from API-only note management to host-side data propagation and possible accidental disclosure or overwrite.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill exposes a generic HTTP forwarding capability through SiYuan that is unrelated to core note-management workflows. This can be used to exfiltrate note contents, tokens, or local-derived data to arbitrary remote endpoints, and may also bypass user expectations that the skill only interacts with a local notes application.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The client exposes a generic network forwarding primitive that can send arbitrary requests to arbitrary URLs through the SiYuan instance. In an agent-skill context, this meaningfully expands scope from note management to unrestricted outbound networking, enabling SSRF-style access, data exfiltration, or abuse of trusted local/network reachability if higher-level callers pass attacker-controlled inputs.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This markdown file documents endpoints such as /api/notebook/removeNotebook that delete user content, but it does not include a warning about potential data loss, confirmation expectations, or whether recovery is possible. Under the markdown-specific SQP-2 criteria, destructive behaviors that affect user data should be disclosed to users.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The putFile and removeFile sections describe writing and deleting files under the workspace, which can directly affect user data and system state. The markdown does not warn users about overwrite/deletion risks, backup considerations, or the need for explicit confirmation before use.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The Pandoc conversion API accepts arbitrary command arguments, which expands the skill from simple note CRUD into a command-like execution surface. Even if Pandoc itself is the only binary invoked, unrestricted arguments can enable unsafe file reads/writes, network fetches depending on features/configuration, or abuse of conversion side effects against workspace data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The forwardProxy API allows outbound HTTP requests and explicitly supports custom headers such as Cookie plus arbitrary payloads, which can transmit sensitive user or system data. The markdown lacks a warning about privacy implications, credential leakage risks, or the need to verify destination URLs before sending data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README prominently advertises create, update, move, delete, and SQL-based search capabilities but does not warn users that these operations can modify or permanently remove note data. In an agent-skill context, this increases the chance that an LLM or user invokes destructive actions without informed consent, especially because the skill is designed to automate notebook and document management.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The CLI tools table lists delete.py, update.py, move.py, and create.py as available commands without any adjacent warning that they can alter or remove user data. In a skill consumed by agents, concise command lists are likely to be used directly, so the absence of warnings or confirmation guidance makes accidental destructive use more likely.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill advertises capabilities that clearly include local file read/write and network access, but it does not declare any explicit tool scope such as permissions or allowed-tools. This makes the trust boundary opaque and increases the chance that an agent or user will invoke powerful operations without understanding the effective access the skill requires.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill documents arbitrary SQL query execution against the SiYuan database, which exceeds normal expectations for a note client and can expose sensitive content or metadata beyond intended APIs. Even if framed as read-only recommended, the capability can facilitate bulk extraction or unsafe queries if the backend permits more than SELECT semantics.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 96% confidence
Finding: The example shows transmission to an external HTTPS endpoint using a bearer token through the proxy feature. In the context of a local notes client, any generic external transmission path materially increases exfiltration risk because note content, metadata, or credentials can be sent off-host to arbitrary services.
Content: Scanner excerpt · SKILL.md (reported line 335)May include surrounding context.
python
# Forward HTTP request through SiYuan proxy response = client.forward_proxy( url="https://api.example.com/data", method="GET", headers=[{"Authorization": "Bearer token"}] )

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The documentation includes destructive delete commands for notebooks, documents, and blocks, including a flag to skip confirmation, without a prominent warning about permanence or recovery limitations. This increases the likelihood of accidental or automated data loss, especially in agent-driven contexts where commands may be executed with limited human review.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 86% confidence
Finding: A documented '--yes' path that skips confirmation for document deletion creates an automation-friendly route to irreversible destructive actions. In an agent skill, reducing friction around destructive operations is especially risky because commands may be composed or executed programmatically without adequate human validation.
Content: Scanner excerpt · SKILL.md (reported line 453)May include surrounding context.
Delete block

python3 tools/delete.py --block block-id

Skip confirmation

python3 tools/delete.py --doc doc-id --yes

text

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: upload_asset reads arbitrary local file paths and transmits their contents to the remote SiYuan server with no built-in guardrails, warnings, or path restrictions. In an agent setting, this can facilitate unintended collection and exfiltration of local sensitive files if file_paths are influenced by untrusted input or broad automation.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The query_sql method exposes direct SQL execution against the backing SiYuan database, which is broader than ordinary notebook/document operations and bypasses safer API-level controls. Even if intended for advanced administration, it can be used to read sensitive data or modify internal state in unsafe ways when invoked by an agent or untrusted caller.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The method documentation recommends read-only queries, but the implementation accepts any statement and forwards it unchanged to the API. This creates a policy/implementation gap that can lead callers to assume safety while still allowing destructive or state-changing SQL to execute.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: put_file can create or overwrite arbitrary workspace files, including binary content, without any safety interlocks or clear disclosure of destructive effects. In a skill environment this increases the chance of silent data modification, persistence of unwanted content, or misuse by higher-level automation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: remove_file performs destructive deletion of workspace files with no confirmation, soft-delete, or user-facing warning. If misused by an agent or passed untrusted paths, it can cause irreversible data loss within the SiYuan workspace.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The forward proxy can transmit arbitrary headers and payloads to arbitrary external URLs without any built-in disclosure or consent step. Combined with agent autonomy, this creates a strong exfiltration and network-abuse surface beyond the skill's stated notebook-management role.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

Code: suspicious.install_untrusted_source
Location: config.example.yaml:10

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

SkillSpector

Context-Inappropriate Capability

Hidden Instructions

Context-Inappropriate Capability

Tp4

Tp4

Tp4

Context-Inappropriate Capability

Context-Inappropriate Capability

Missing User Warnings

Missing User Warnings

Context-Inappropriate Capability

Missing User Warnings

Missing User Warnings

Missing User Warnings

Undeclared Tool Scope

Context-Inappropriate Capability

External Transmission

Missing User Warnings

Autonomous Decision Making

Delete block

Skip confirmation

Missing User Warnings

Context-Inappropriate Capability

Intent-Code Divergence

Missing User Warnings

Missing User Warnings

Missing User Warnings

Static analysis

Install source points to URL shortener or raw IP.