ClawHub
Back to skill

Security audit

Flomo Notes

Security checks across malware telemetry and agentic risk

Overview

This skill transparently sends user-selected notes to a user-configured Flomo webhook and shows no hidden access, persistence, or unrelated behavior.

Install this only if you want selected note text sent to Flomo over the network. Keep FLOMO_WEBHOOK_URL private because anyone with it can post to your inbox, avoid sending secrets or highly sensitive notes, and be aware the current docs should invoke the script with note text on stdin rather than as a command argument.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill invokes a shell script (`bash scripts/save_to_flomo.sh`) but does not declare permissions or clearly signal that it has shell execution capability. This creates a transparency and policy gap: operators may approve or install the skill without realizing it executes commands and sends data externally, increasing the chance of unintended data handling or abuse if the script is modified later.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The trigger conditions are broad enough that ordinary conversation about Flomo or note-taking could activate the skill and cause user content to be sent to an external webhook. In this skill's context, accidental activation is more dangerous because the action is not purely local: it exfiltrates note text to a third-party service endpoint tied to a secret inbox URL.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill description explains that it saves notes to Flomo but does not prominently warn users that note content will be transmitted to an external webhook endpoint. This can lead to users disclosing sensitive notes under the assumption they are being handled locally, especially since webhook-based ingestion is effectively data transfer to an external service.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.