Security audit
Joplin API（中文）
Security checks across malware telemetry and agentic risk
Overview
This is a disclosed Joplin note-management skill with sensitive but purpose-aligned read, write, delete, token, and optional SSH behavior.
Install only if you are comfortable giving the skill access to your Joplin notes. Prefer local mode when possible, keep the .env token file private, preview notes before changing or deleting them, and treat remote SSH mode and permanent deletion as higher-impact actions that should require clear user confirmation.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
64/64 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.