Security audit
Security checks for vulnerabilities and agentic risk
The skill is a coherent Joplin note helper, but its SSH remote mode can turn crafted note arguments into command execution on the configured remote host.
Install only if you plan to use local Joplin access or you fully trust and control any SSH target. Avoid SSH remote mode until the scripts validate IDs and fields and stop interpolating URLs and tokens into remote shell commands. Review write and delete actions carefully, especially permanent deletion.
scripts/joplin.py:56Remote Shell Command Injection Through Unescaped Joplin Request URL in Python Client
scripts/joplin.sh:63Remote Shell Command Injection Through Unescaped Joplin Request URL in Bash Client
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Custom ID: supply 32-char hex string as `id` property.
### Delete Note (DELETE /notes/:id)
Default: move to trash. Add `?permanent=1` for permanent deletion.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Default: move to trash. Add `?permanent=1` for permanent deletion.
### DELETE /notes/:id/revisions
Delete all revisions for a note.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
**Note:** When no `fields` parameter is specified, the API may return a tree structure with `children` key. When `fields` is specified, it returns a flat paginated list.
### DELETE /folders/:id
Default: move to trash. Add `?permanent=1` for permanent deletion.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Add tag to a note. Note data must contain at least an `id` property.
### DELETE /tags/:id/notes/:note_id
Remove tag from note.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
set -euo pipefail
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
ENV_FILE="$SCRIPT_DIR/../.env"
# ── Load .env ──────────────────────────────────────────────
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
set -euo pipefail
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
ENV_FILE="$SCRIPT_DIR/../.env"
# ── Load .env ──────────────────────────────────────────────
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
ENV_FILE="$SCRIPT_DIR/../.env"
# ── Load .env ──────────────────────────────────────────────
if [[ ! -f "$ENV_FILE" ]]; then
echo "Error: $ENV_FILE not found. Copy .env.example to .env and set api_token." >&2
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
ENV_FILE="$SCRIPT_DIR/../.env"
# ── Load .env ──────────────────────────────────────────────
if [[ ! -f "$ENV_FILE" ]]; then
echo "Error: $ENV_FILE not found. Copy .env.example to .env and set api_token." >&2
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
ENV_FILE="$SCRIPT_DIR/../.env"
# ── Load .env ──────────────────────────────────────────────
if [[ ! -f "$ENV_FILE" ]]; then
echo "Error: $ENV_FILE not found. Copy .env.example to .env and set api_token." >&2
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
ENV_FILE="$SCRIPT_DIR/../.env"
# ── Load .env ──────────────────────────────────────────────
if [[ ! -f "$ENV_FILE" ]]; then
echo "Error: $ENV_FILE not found. Copy .env.example to .env and set api_token." >&2
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
ENV_FILE="$SCRIPT_DIR/../.env"
# ── Load .env ──────────────────────────────────────────────
if [[ ! -f "$ENV_FILE" ]]; then
echo "Error: $ENV_FILE not found. Copy .env.example to .env and set api_token." >&2
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
ENV_FILE="$SCRIPT_DIR/../.env"
# ── Load .env ──────────────────────────────────────────────
if [[ ! -f "$ENV_FILE" ]]; then
echo "Error: $ENV_FILE not found. Copy .env.example to .env and set api_token." >&2
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
ENV_FILE="$SCRIPT_DIR/../.env"
# ── Load .env ──────────────────────────────────────────────
if [[ ! -f "$ENV_FILE" ]]; then
echo "Error: $ENV_FILE not found. Copy .env.example to .env and set api_token." >&2
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
ENV_FILE="$SCRIPT_DIR/../.env"
# ── Load .env ──────────────────────────────────────────────
if [[ ! -f "$ENV_FILE" ]]; then
echo "Error: $ENV_FILE not found. Copy .env.example to .env and set api_token." >&2
The skill invokes shell commands, reads local files, and performs network access to a local or SSH-forwarded Joplin API, yet it declares no explicit tool scope or allowed-tools boundary. Without a least-privilege declaration, an agent runtime may grant broader capabilities than necessary, increasing the chance of unintended file access, command execution, or network use beyond the documented Joplin workflow.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
---
name: joplin-api
description: 通过 Joplin Data API（Clipper Server）查询和管理笔记、笔记本、标签。支持本地直连和 SSH 远程两种模式。包含读写删全部操作，写/删需用户确认。触发词："查 Joplin"、"Joplin 笔记"、"joplin search"、"create note in joplin" 等。
version: 1.4.1
metadata:
openclaw:
The trigger description includes broad phrases like managing notes and examples such as 'create note in joplin', but it does not narrowly constrain when the skill should activate or what safety checks must precede sensitive operations. Over-broad activation increases the risk that an agent invokes a capability-bearing skill in contexts the user did not intend, especially since the skill supports create, update, delete, shell, and remote network behaviors.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
### API Token 安全
- Token 通过 URL 查询参数传递（`?token=xxx`），这是 Joplin Clipper API 的设计
- 注意：URL 可能被记录在 shell 历史、SSH 日志、代理日志中
- 建议：`.env` 文件权限设为 `600`（`chmod 600 .env`），并通过 `.gitignore` 排除
### 删除操作警告
- `delete <id>` 默认**软删除**（移至回收站，可在 Joplin 中恢复）
This markdown file describes deleting notes, permanently deleting them with ?permanent=1, and deleting all note revisions, but it does not include any warning about irreversibility or potential data loss. Under the markdown-specific warning rule, destructive behaviors that can affect user data should be accompanied by a clear caution.
The documentation states that folders can be deleted and permanently deleted via ?permanent=1, but it provides no caution about the impact on user data or the irreversible nature of permanent deletion. Markdown skill documentation should warn users about behaviors affecting stored content or system integrity.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Uses multipart/form-data:
curl -F 'data=@/path/to/file.jpg' \
-F 'props={"title":"my resource title"}' \
"http://localhost:41184/resources?token=$JOPLIN_TOKEN"
This skill transmits Joplin note data, including note bodies and API tokens in URLs, over HTTP to a local or SSH-forwarded service and via remote curl execution. In the skill context, the tool is explicitly designed to read, create, update, and delete notes, so external transmission is expected; however, it still expands the attack surface because sensitive note content may be exposed through command arguments, process inspection, logs, or an insecure base_url if reconfigured away from localhost.
# Inside single quotes, $ is literal — no backslash needed
remote_cmd = (
"JOP_URL='" + url + "' JOP_BODY='" + b64 + "' JOP_METHOD=" + method + " "
"bash -c 'curl -s -X $JOP_METHOD "
"-H \"Content-Type: application/json\" "
"-d \"$(echo \"$JOP_BODY\" | base64 -d)\" "
"\"$JOP_URL\"'"
The code builds a remote shell command string and passes it to ssh for execution on the remote host. Although the author comments that no raw user input reaches the shell, the URL contains path/query components derived from command arguments such as note IDs, fields, folder IDs, and limits, and these values are embedded into shell-quoted environment assignments without robust escaping. A crafted value containing shell metacharacters or quotes could break out on the remote side and lead to command injection.
# JOP_URL/JOP_BODY/JOP_METHOD are env-var indirection to bypass zsh globbing.
# No raw user input reaches the shell — method is whitelisted (GET/POST/PUT/DELETE),
# body is base64-encoded, URL is built by build_url() above.
result = subprocess.run(
["ssh", HOST, remote_cmd],
capture_output=True, text=True, check=True
)
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def cmd_ping():
if HOST:
try:
result = subprocess.run(
["ssh", HOST, "curl -s http://127.0.0.1:41184/ping"],
capture_output=True, text=True, check=True
)
In remote mode, note content and the API token are transmitted over SSH to another host and then sent to the remote Joplin Clipper endpoint. This is intentional functionality, but it still expands the trust boundary: sensitive note contents and credentials leave the local machine and may be exposed on the remote host through process arguments, shell history, logging, or compromise of that host.
local b64
b64=$(printf '%s' "$data" | base64 -w 0)
# Use env vars + bash -c to avoid zsh globbing on remote macOS
ssh "$HOST" "JOP_URL='${url}' JOP_BODY='${b64}' JOP_METHOD=${method} bash -c 'curl -s -X \$JOP_METHOD -H \"Content-Type: application/json\" -d \"\$(echo \"\$JOP_BODY\" | base64 -d)\" \"\$JOP_URL\"'"
else
# Use env var to avoid zsh globbing on remote macOS
ssh "$HOST" "JOP_URL='${url}' JOP_METHOD=${method} bash -c 'curl -s -X \$JOP_METHOD \"\$JOP_URL\"'"