Trilium

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 6:57 AM UTC
• Version: 0.0.1

Overview

This is a straightforward Trilium ETAPI reference skill, but users should be careful because it documents authenticated operations that can modify, export, back up, or delete notes.

Install only if you intend the agent to help operate a Trilium ETAPI server. Treat TRILIUM_TOKEN and passwords as secrets, use HTTPS for remote servers, review any export or backup target, and require explicit confirmation before deleting notes, branches, attributes, or attachments.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (17)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 89% confidence

Finding

This skill exposes a destructive delete operation over user-supplied noteId without any documented guardrails such as confirmation, scoping, or protected-resource checks at the skill layer. In an agent context, parameter abuse or hallucinated identifiers could cause irreversible deletion of user notes, making this more dangerous than ordinary API docs because the skill is meant to drive automated actions.

Content

Scanner excerpt · api-reference.md (reported line 67)May include surrounding context.

md

### `PATCH /notes/{noteId}`
Patches `title`, `type`, `mime`, `dateCreated`, `utcDateCreated` only. Use the content endpoint below to change content. Body is a partial `Note`. Response 200 = updated `Note`.

### `DELETE /notes/{noteId}`
Deletes the note. Response 204.

### `GET /notes/{noteId}/content`

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 93% confidence

Finding

Deleting a branch can implicitly delete the child note when it is the last branch, which creates a non-obvious destructive side effect from a seemingly narrower operation. In an agent/tooling setting this is a strong parameter-abuse risk because an incorrect branchId can cascade into permanent note loss.

Content

Scanner excerpt · api-reference.md (reported line 111)May include surrounding context.

md

### `PATCH /branches/{branchId}`
**Patches `prefix` and `notePosition` only.** Re-parenting requires DELETE + POST a new branch.

### `DELETE /branches/{branchId}`
**Warning**: if this is the last branch of the (child) note, the note is deleted too. Response 204.

---

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Attribute deletion is a state-changing operation that can materially alter note metadata, labels, and relations, and could break search, organization, or automation behavior if the wrong attributeId is passed. In an interactive agent context, unrestricted acceptance of arbitrary identifiers creates a credible tool-parameter abuse path even if the impact is less severe than deleting notes.

Content

Scanner excerpt · api-reference.md (reported line 141)May include surrounding context.

md

- relation: `position` only
- Anything else → delete + recreate.

### `DELETE /attributes/{attributeId}`
Response 204.

---

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Deleting an attachment removes stored content and may destroy important files or embedded resources associated with notes. Because this skill is intended for automated ETAPI interactions, accepting an arbitrary attachmentId without confirmation or preview creates a meaningful parameter-abuse risk and potential data loss.

Content

Scanner excerpt · api-reference.md (reported line 169)May include surrounding context.

md

### `PATCH /attachments/{attachmentId}`
**Patches `role`, `mime`, `title`, `position` only.**

### `DELETE /attachments/{attachmentId}`
Response 204.

### `GET /attachments/{attachmentId}/content`

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger description activates on very broad indicators such as any mention of 'Trilium', 'ETAPI', 'noteId', 'branchId', or any '/etapi/' URL. This can cause the skill to be invoked in contexts it does not fully understand, increasing the chance that destructive API guidance or authenticated shell commands are suggested when the user intent is ambiguous.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

If you only have a password (and the server allows password login), exchange it for a token:

bash

curl -sX POST "$TRILIUM_URL/etapi/auth/login" \
  -H 'Content-Type: application/json' \
  -d '{"password":"YOUR_PASSWORD"}' | jq -r .authToken

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The documentation prominently includes destructive operations like deleting notes and notes' last branches without an explicit safety warning or confirmation requirement. In an agent setting, this raises the risk that a user or downstream system follows deletion guidance and causes irreversible data loss.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.

2. Create a text note

bash

curl -sX POST "$TRILIUM_URL/etapi/create-note" \
  -H "Authorization: $TRILIUM_TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.

Content lives on a separate endpoint and the body is text/plain even when the content is HTML:

bash

curl -sX PUT "$TRILIUM_URL/etapi/notes/$NOTE_ID/content" \
  -H "Authorization: $TRILIUM_TOKEN" \
  -H 'Content-Type: text/plain' \
  --data-binary @body.html

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 125)May include surrounding context.

5. Tag a note

bash

curl -sX POST "$TRILIUM_URL/etapi/attributes" \
  -H "Authorization: $TRILIUM_TOKEN" \
  -H 'Content-Type: application/json' \
  -d "{

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 148)May include surrounding context.

7. Clone a note to another location (branch)

bash

curl -sX POST "$TRILIUM_URL/etapi/branches" \
  -H "Authorization: $TRILIUM_TOKEN" \
  -H 'Content-Type: application/json' \
  -d "{

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 213)May include surrounding context.

md

NOTE_ID=$(curl -s "$TRILIUM_URL/etapi/calendar/days/$TODAY" \
  -H "Authorization: $TRILIUM_TOKEN" | jq -r .noteId)

OLD=$(curl -s "$TRILIUM_URL/etapi/notes/$NOTE_ID/content" \
  -H "Authorization: $TRILIUM_TOKEN")

NEW="${OLD}<p>$(date +%H:%M) — $1</p>"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown file documents a DELETE endpoint that removes notes, but it provides no user-facing warning about the destructive and potentially irreversible nature of the operation. Under the markdown criteria for missing warnings, actions affecting user data should include an explicit caution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This documentation lists DELETE /attachments/{attachmentId} with no caution that it removes attachment data. For markdown files, destructive operations affecting user data should include explicit warnings so users understand the risk before invoking them.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The authentication section instructs users to export and pass a long-lived ETAPI token, and even exchange a password for a token, without emphasizing secure handling. This can lead to accidental exposure through shell history, process listings, logs, copied transcripts, or unsafe reuse of credentials.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The markdown describes an import operation that writes new content into the note tree, but it does not disclose that this changes user data and may create many notes or attachments. The skill description should warn users when operations can materially alter stored content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The documentation states that a backup file is written into the server's data directory, but it does not warn that this creates a persisted copy of potentially sensitive user data on disk. Markdown documentation should disclose behaviors with privacy or system-integrity implications.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.