Flomo Notes

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:44 AM UTC
• Version: 0.1.0

Overview

This skill is a coherent Flomo note-saving integration, but it has review-worthy handling risks around the webhook secret and mismatched note input instructions.

Install only if you are comfortable giving the skill a Flomo inbox webhook that can create notes. Avoid enabling FLOMO_DEBUG, keep gateway logs restricted, and verify the invocation is fixed to use stdin or argument input consistently before relying on it for sensitive notes.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/save_to_flomo.sh:24

Finding

Flomo Webhook Secret Disclosure Through Curl Debug Logging

Content

View full analysis

Vulnerability Details

File Location: scripts/save_to_flomo.sh, lines 24-25 and 33-39
Vulnerability Type: Sensitive URL disclosure through verbose diagnostic output
Risk Level: Medium

Vulnerable Code:

bash

if [[ "${FLOMO_DEBUG:-}" != "" ]]; then
  echo "[flomo-notes] payload_bytes=$(printf %s "$JSON_PAYLOAD" | wc -c | tr -d ' ')" >&2
  echo "[flomo-notes] posting to FLOMO_WEBHOOK_URL (redacted)" >&2
fi

curl -sS -X POST "$FLOMO_WEBHOOK_URL" \
  -H "Content-type: application/json" \
  -d "$JSON_PAYLOAD" \
  ${FLOMO_DEBUG:+-v} \
  >/dev/null

Technical Analysis

FLOMO_WEBHOOK_URL contains a secret Flomo inbox token in its URL path. When FLOMO_DEBUG is nonempty, ${FLOMO_DEBUG:+-v} enables curl's verbose mode.

Although the preceding diagnostic message says that the URL is redacted, curl -v independently writes request diagnostics to standard error. These diagnostics can include the complete request URL, including the secret webhook path. Standard error is commonly collected by OpenClaw gateways, service managers, CI systems, containers, and centralized logging platforms.

The issue does not require shell command injection. It occurs through the normal debug feature whenever the environment variable is enabled or inherited.

Attack Path

1. A user, administrator, or execution environment sets FLOMO_DEBUG to any nonempty value.
2. The skill invokes scripts/save_to_flomo.sh with a configured FLOMO_WEBHOOK_URL.
3. The parameter expansion adds -v to the curl command.
4. Curl emits verbose request information to standard error.
5. The gateway, service, or CI logging system records that output.
6. An attacker or unauthorized operator with access to those logs obtains the webhook URL.
7. The attacker sends arbitrary POST requests to the exposed webhook and injects unauthorized content into the victim's Flomo inbox.

Impact Assessment

Exploitation does ...[truncated 553 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove ${FLOMO_DEBUG:+-v} and never use curl verbose mode with a credential embedded in the URL.
2. Implement bounded diagnostics that do not print request URLs or headers. For example, capture only the HTTP status code with --write-out '%{http_code}'.
3. If endpoint diagnostics are necessary, log only a fixed service name such as flomoapp.com; do not log the webhook path, query string, or token.
4. Ensure error-handling paths also redact the URL before writing messages to standard error.
5. Treat existing debug logs as potentially compromised. Delete or restrict affected logs and rotate the Flomo webhook if verbose mode has previously been used.
6. Add an automated test that enables FLOMO_DEBUG, captures standard error, and verifies that neither the webhook token nor the complete URL appears in output.

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:35

Finding

Documented Invocation Is Incompatible With the Script Input Interface

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 35; README.md, lines 82-83; scripts/save_to_flomo.sh, line 7
Vulnerability Type: Inconsistent input handling and operational interface
Risk Level: Low

Documented Invocation:

bash

bash scripts/save_to_flomo.sh "<note text>"

The README similarly instructs users to run:

bash

FLOMO_WEBHOOK_URL="https://flomoapp.com/iwh/XXXX..." \
  bash scripts/save_to_flomo.sh "hello from openclaw"

Implemented Input Handling:

bash

# Read note from stdin (works with pipes and multi-line content)
NOTE="$(cat)"

Technical Analysis

The documentation supplies note content as the first positional argument, but the script never reads $1 or any other positional parameter. It exclusively calls cat and consumes standard input.

In an interactive terminal, the documented command can wait for standard input despite receiving an argument. In noninteractive agent execution, standard input may be empty, causing the subsequent empty-input check to terminate with an error. If unrelated inherited data is available on standard input, the script could submit that data instead of the note supplied as an argument.

This is primarily an availability and input-integrity defect rather than a privilege-escalation vulnerability. No command-injection path is created because the ignored argument is not evaluated or incorporated into a shell command.

Attack Path

1. An agent or user follows the invocation specified in SKILL.md or README.md.
2. The intended note is passed as the first command-line argument.
3. The script ignores that argument and reads standard input through cat.
4. If standard input is empty, the script reports Error: No input provided and does not save the note.
5. If standard input contains inherited or piped content, that content is used as the note instead of the supplied argument.
6. The operation may ...[truncated 603 chars]

Remediation

View remediation

Remediation Suggestions

1. Define one canonical input interface and make the implementation and all documentation consistent.

2. If positional arguments are intended, safely read them without evaluation:

   bash

   if (( $# > 0 )); then
     NOTE="$*"
   else
     NOTE="$(cat)"
   fi
   

3. If standard input is the intended interface, change every example to use a pipe or here-document:

   bash

   printf '%s' "hello from openclaw" | bash scripts/save_to_flomo.sh
   

4. Prefer standard input for multiline or sensitive content because command-line arguments may be visible to local process-inspection tools.

5. Add tests covering positional input, piped input, multiline content, empty input, and noninteractive execution.

6. Make failures explicit and nonblocking by detecting whether an accepted input source was provided before calling cat where practical.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 30)May include surrounding context.

Option A (recommended): copy into ~/.openclaw/skills/

bash

mkdir -p ~/.openclaw/skills/flomo-notes
cp -R /Users/robertshaw/GitHub/aigc/openclaw-plugin-flomo/* ~/.openclaw/skills/flomo-notes/

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill invokes a shell script but does not declare any tool restrictions such as explicit allowed tools or permissions. This creates unnecessary execution scope ambiguity: an agent/runtime may permit shell access more broadly than intended, increasing the chance of command execution in contexts where only narrow network posting behavior was expected.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/save_to_flomo.sh (reported line 30)May include surrounding context.

sh

echo "[flomo-notes] posting to FLOMO_WEBHOOK_URL (redacted)" >&2
fi

# Mirror the working curl form as closely as possible.
# -sS: silent but show errors
# -X POST: explicit POST
# -H Content-type: application/json: match Flomo docs

Static analysis

No suspicious patterns detected.