Security audit

quick-note-tool

Security checks for vulnerabilities and agentic risk

Overview

This local note-taking skill is mostly purpose-aligned, but its delete command can be abused to run local shell commands and its docs normalize storing API-key-like notes in plaintext.

Review before installing. Use only for non-sensitive notes, avoid passwords, tokens, API keys, and personal data, and do not use the delete command until the note ID is strictly validated and the sed-based deletion is replaced or safely escaped.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/note.sh:74
Finding: Arbitrary Command Execution via sed Program Injection in Note Deletion
Content: View full analysis
Remediation: View remediation
&2 return 1 fi ``` 2. Do not construct executable sed programs from untrusted input. After validation, use a static parser or an `awk` implementation that passes the identifier as data through `-v` rather than inserting it into program source. 3. Use fixed-string matching where regular expressions are unnecessary: ```bash grep -Fq "[$id]" "$NOTES_FILE" ``` Strict ID validation is still required to ensure the operation can target only valid note identifiers. 4. Write updates to a securely created temporary file using `mktemp`, verify successful processing, and atomically replace the original file. Install a `trap` to remove temporary files on failure. 5. Add regression tests for malformed identifiers containing `/`, `\`, newlines, semicolons, BRE alternation, sed command characters, and shell metacharacters. Confirm that every invalid identifier is rejected before any file is copied or modified. 6. Run the Skill with least privilege and prevent it from accessing credentials or files unrelated to note management, reducing the impact of any future command-execution defect. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The code generally aligns with the declared purpose of quick note-taking and snippet storage: it stores text notes, supports reading them via search/list/tag commands, and organizes them in a markdown file. However, it also includes a delete operation that removes notes and creates backup files. That deletion capability is a materially undeclared behavior beyond simply saving/reading snippets. Resource access remains local to a notes file and backup in the notes directory, which is consistent with the general domain of note management.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 92% confidence
Finding: The example search output references 'API key stored in .env file,' which normalizes handling credential-related information inside notes and points users toward secret locations. In context, this is especially risky because the skill is designed to persist snippets, making credential capture or disclosure more likely if users imitate the example.
Content: Scanner excerpt · SKILL.md (reported line 98)May include surrounding context.
API endpoint: https://api.example.com

📝 #ID-005 (2026-03-09) API key stored in .env file

text

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README explicitly advertises persistent note storage and includes an example of saving an API key, but provides no warning that notes may be stored in plaintext in the workspace and exposed to other tools, users, backups, or version control. This can normalize unsafe handling of secrets and lead users to place credentials into an insecure storage mechanism.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The trigger phrases are broad enough that normal conversation such as 'remember this' or 'save this' could activate the skill unintentionally. That can cause sensitive content to be written to a workspace file without clear user intent, increasing privacy and data handling risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly stores arbitrary user-provided notes in a workspace file but does not warn that secrets, credentials, or personal data may be persisted in plain text. In the provided examples, even an API key is shown as note content, which makes accidental secret storage more likely.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script exposes a delete capability even though the skill is described as supporting only saving and reading short text snippets. This creates a privilege/behavior mismatch: a user or calling agent may invoke destructive functionality that is not expected from the manifest, leading to accidental or unauthorized data loss. In a note-taking skill, hidden destructive actions are especially risky because users reasonably expect persistence, not deletion.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The delete operation edits the notes file in place without any confirmation, dry-run, or warning, so a mistaken or unintended invocation can immediately remove stored notes. Although a backup is created, the action is still destructive by default and easy to trigger in an agent context where commands may be composed automatically from user phrasing.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The inline comment says the simplified behavior 'removes line with ID', but the sed range expression deletes from the matching ID line through the next '---' separator. This documentation actively misstates the scope of the deletion side effect.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.