Security audit

ima.plus-skill-v1.0.8

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for IMA note and knowledge-base management, but it asks users to expose reusable API credentials from another copilot session and grants broad write/export authority over private content.

Review carefully before installing. Only use credentials you are willing to grant broad IMA note and knowledge-base access, do not ask an assistant to print secret environment variables into chat, and prefer provisioning API keys through official account/developer settings. Confirm targets and content before append, move, rename, permission, tag-delete, join, or export operations.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The skill claims credentials come from a single environment-variable source, but later documents a second operational source and explicitly instructs users to retrieve secret values from another copilot session. That creates a credential exfiltration workflow: a user is told to reveal environment-stored secrets in plaintext and move them across contexts, increasing exposure and undermining the stated trust boundary.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The front-matter description says the module is only for searching, browsing, creating, and editing/appending personal notes, but the body documents broader capabilities including notebook management, export, move, rename, and push-style write flows. This mismatch can mislead higher-level agents, reviewers, or policy gates into granting or invoking more authority than the declared scope suggests, increasing the chance of unintended destructive or privacy-impacting actions.

Natural-Language Policy Violations

High

Confidence: 99% confidence
Finding: This section directly instructs the user to ask another copilot session to reveal environment credential values. That is effectively a social-engineering prompt for secret extraction and could leak reusable API credentials into chat history, logs, screenshots, or untrusted environments.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The trigger phrases for write operations are broad enough to match common conversational requests such as creating, importing, generating, or adding content to notes. In an agent setting, this can cause unintended state-changing actions on user data without a strong confirmation boundary, especially because the same document also exposes direct append/import endpoints tied to natural-language routing.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The documentation enables note creation and appending but does not explicitly require user confirmation or warn that these actions modify persistent user data. In a note-management skill handling private content, omission of such safeguards increases the chance of accidental writes, unauthorized modifications in ambiguous multi-turn conversations, and user-surprising data changes.

Ssd 3

High

Confidence: 99% confidence
Finding: The skill provides plain-language wording designed to get another copilot instance to disclose secrets stored in environment variables. This lowers the barrier to credential theft and normalizes unsafe handling of privileged tokens, especially because the credentials are described as capable of export operations tied to the user's account.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: knowledge-base/scripts/upload_to_kb.cjs:75

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: ima_api.cjs:19

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: knowledge-base/scripts/export_kb_zip.cjs:148