Echo Seed

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:10 AM UTC
• Version: 1.0.1

Overview

Echo Seed is a real note-capture app, but it exposes private notes on the network and can automatically send note or link content to external services without effective opt-in controls.

Install only after reviewing the network exposure and external-sync behavior. Run it on localhost or behind authentication, disable or remove external AI/Notion/Calendar calls unless you explicitly want them, avoid submitting private/internal URLs, and update dependencies before using it with sensitive notes.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/echo-web.py:300

Finding

Automatic Disclosure of Private Note Content to Third-Party Services Without Effective Opt-In

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/echo-web.py:238

Finding

Unauthenticated LAN-Wide Access to Private Notes and Destructive API Operations

Content

View full analysis

', methods=['DELETE']) def delete_capsule(capsule_id): conn = get_db() cursor = conn.cursor() cursor.execute('DELETE FROM capsules WHERE id = ?', (capsule_id,)) conn.commit() conn.close() return jsonify({'success': True}) ``` `scripts/echo-web.py:531-552`: ```python @app.route('/api/export/', methods=['GET']) def export_capsules(format): conn = get_db() cursor = conn.cursor() capsule_type = request.args.get('type') search = request.args.get('search') query = 'SELECT * FROM capsules WHERE 1=1' params = [] ``` `scripts/echo-web.py:723`: ```python app.run(host='0.0.0.0', port=5000, debug=False, use_reloader=False) ``` ### Technical Analysis The Flask application does not implement authenticat ...[truncated 1977 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/ai_service.py:94

Finding

Server-Side Request Forgery Through User-Controlled URLs With TLS Verification Disabled

Content

View full analysis

dict: try: response = requests.get(url, timeout=timeout, verify=False) response.raise_for_status() html = response.text title = "" if "" in html: title = html.split("<title>")[1].split("")[0].strip() import re content = re.sub(r'<[^>]+>', '', html) content = content[:5000] return { "success": True, "title": title, "content": content[:3000], "url": url } ``` `scripts/ai_service.py:232-248`: ```python prompt = f"""Analyze the following webpage content: Title: {web_content.get('title', 'Untitled')} URL: {url} Content: {web_content.get('content', '')[:2000]} Summarize the content, extract keywords, and suggest tags.""" result = call_xiaoxiaozhao(prompt, LINK_SYSTEM_PROMPT) if result["success"]: save_analysis( capsule_id, "link", url, result["text"], result["tokens_used"] ) ``` ### Technical Analysis The URL originates from an HTTP request and is fetched by the ...[truncated 2038 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: templates/index.html:313

Finding

Stored Cross-Site Scripting Through Unescaped Capsule Fields

Content

View full analysis

{ const typeConfig = { note: { emoji: '📝', color: 'bg-gray-100', border: 'border-gray-300' }, idea: { emoji: '💡', color: 'bg-orange-50', border: 'border-orange-300' }, link: { emoji: '🔗', color: 'bg-blue-50', border: 'border-blue-300' }, diary: { emoji: '📔', color: 'bg-green-50', border: 'border-green-300' }, thought: { emoji: '💭', color: 'bg-purple-50', border: 'border-purple-300' }, collection: { emoji: '⭐', color: 'bg-pink-50', border: 'border-pink-300' }, todo: { emoji: '✅', color: 'bg-red-50', border: 'border-red-300' }, voice: { emoji: '🎤', color: 'bg-cyan-50', border: 'border-cyan-300' } }[c.type] || { emoji: '📝', color: 'bg-gray-100', border: 'border-gray-300' }; return `

${typeConfig.emoji} ${c.type} ${c.tags ? `${c.tags.split(',')[0]}` : ''}

${c.title || c.content?.slice(0, 30) || 'Untitled'}

${c.content?.slice(0, 100) || ''}${c.content?.length > 100 ? '...' : ...[truncated 2982 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: templates/index.html:7

Finding

Unpinned Remote JavaScript Executes With Full Application-Origin Privileges

Content

View full analysis

``` `templates/index.html:216`: ```html ``` ### Technical Analysis The page executes JavaScript retrieved at runtime from two external CDNs. Neither script uses Subresource Integrity. The Vue URL selects the mutable `vue@3` major-version range rather than an exact immutable artifact, while the Tailwind runtime CDN URL is also not tied to a reviewed build. Remote scripts execute with the same browser-origin privileges as first-party application code. They can read rendered private notes and call all same-origin APIs. This is particularly consequential because the backend API itself has no authentication. This issue does not prove that either current CDN asset is malicious. It creates a supply-chain trust path through which an upstream compromise or unexpected package change can become arbitrary application-origin code execution. ### Attack Path 1. A CDN, package publisher account, DNS path, or mutable upstream asset is compromised or unexpectedly changed. 2. A user opens the Echo Seed interface. 3. The browser downloads the changed JavaScript directly from the external source. 4. The script executes in the Echo Seed page without an integrity check. 5. The script reads displayed or API-accessible notes and sends them elsewhere, modifies records, or invokes privileged application endpoints. ### Impact Assessment A compromised remote dependency can obtain all privileges available to JavaScript in the Echo Seed origin, including: - Reading capsule data through the API - Exporting private notes - Creating or deleting capsules - Triggering AI, Notion, and calendar operations - Altering the interface to capture additional use ...[truncated 203 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (52)

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Automatic Google Calendar synchronization is a sensitive external side effect that is not justified by the stated purpose of a simple note/idea capture tool. If enabled by default, the system can create or alter calendar data based on imperfect AI/Todo inference, leading to unauthorized modifications, privacy leakage, and user harm from false events or exposed personal content.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The Todo recognition rules explicitly allow direct automatic calendar sync after AI analysis and even state 'or directly sync' for implicit todos, without consistently requiring user confirmation. Because AI inference from natural language is error-prone, this can cause unauthorized event creation, leakage of sensitive note content into a third-party service, and repeated unintended actions at scale.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The documented feature set includes external sync to Notion, Google Calendar integration, Telegram messaging, AI analysis, and export functions, yet the skill is still framed as a simple idea tool with no declared permissions. This broad undeclared behavior can lead to inadvertent exfiltration of notes, todos, links, and derived analysis data to multiple external services.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The documented feature set includes external sync to Notion, Google Calendar integration, Telegram messaging, AI analysis, and export functions, yet the skill is still framed as a simple idea tool with no declared permissions. This broad undeclared behavior can lead to inadvertent exfiltration of notes, todos, links, and derived analysis data to multiple external services.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The documented feature set includes external sync to Notion, Google Calendar integration, Telegram messaging, AI analysis, and export functions, yet the skill is still framed as a simple idea tool with no declared permissions. This broad undeclared behavior can lead to inadvertent exfiltration of notes, todos, links, and derived analysis data to multiple external services.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The documented feature set includes external sync to Notion, Google Calendar integration, Telegram messaging, AI analysis, and export functions, yet the skill is still framed as a simple idea tool with no declared permissions. This broad undeclared behavior can lead to inadvertent exfiltration of notes, todos, links, and derived analysis data to multiple external services.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.

md

# Google Calendar（可选）
google_calendar:
  enabled: false
  credentials_file: "credentials.json"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · config.example.yaml (reported line 22)May include surrounding context.

yaml

# Google Calendar（可选）
google_calendar:
  enabled: false
  credentials_file: "credentials.json"

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Creating a capsule automatically sends user-supplied title/content to external Notion and optionally Google Calendar, and also emits notification content to a queue file for later Telegram-style delivery. For a tool presented as a simple idea-capture app, this is a significant hidden capability and can cause unintended data disclosure to third-party services without clear user consent at the point of submission.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The design materially expands a simple idea-capture tool into an autonomous system that performs AI analysis and can trigger downstream external actions. This increases data processing and behavioral scope beyond the stated product purpose, creating privacy and consent risks because user-entered content may be analyzed and acted on automatically without an explicit opt-in boundary.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The design describes Google Calendar synchronization without a clear warning that the application may modify external calendar data. Lack of upfront disclosure undermines informed consent and can surprise users with persistent changes in third-party services, especially when changes are triggered automatically from free-form content.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

Link analysis that fetches and extracts webpage content introduces network-driven processing beyond the expected scope of an idea capture tool. This can expose the system to untrusted remote content, unexpected data collection, privacy issues, and potentially unsafe URL handling if retrieval is not tightly validated and sandboxed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README describes a URL analysis feature that fetches webpage content and summarizes it with AI, but it does not disclose that remote content may be retrieved and then transmitted for processing. This creates a privacy and data-handling risk because users may submit internal, sensitive, or access-controlled URLs without understanding that page contents could leave the local environment or be processed by a third party.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documented schema stores raw AI input_content and output_content, which are likely to contain user-entered ideas, URLs, scraped webpage text, and potentially sensitive or regulated data. Without minimization, redaction, retention, or access-control guidance, this increases the blast radius of any database compromise and may create unnecessary long-term exposure of private data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The configuration section explicitly shows use of a third-party AI API, but the documentation does not warn that user ideas, URLs, extracted webpage content, and generated analyses may be transmitted outside the system. The dangerous part is the absence of transparency and consent around external data sharing, which can lead to unintentional disclosure of confidential or personal information.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 84% confidence

Finding

The documented external API endpoint confirms that analysis data is sent to an outside service. While external API use is not inherently malicious, it is security-relevant here because the skill processes user ideas and webpage contents, so transmission to a third party can expose sensitive information if not clearly disclosed and controlled.

Content

Scanner excerpt · README-AI.md (reported line 178)May include surrounding context.

在 scripts/ai_service.py 中配置：

python

XIAOXIAOZHAO_CONFIG = {
    "base_url": "https://api.minimaxi.com/anthropic/v1",
    "api_key": "sk-xxx",
    "model": "MiniMax-M2.5"
}

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The README advertises third-party sync and AI features but does not clearly disclose that user notes, URLs, or extracted content may be transmitted to external services such as Notion, Google Calendar, Telegram, or an AI provider. This creates a privacy and data-handling risk because users may assume all content stays local in SQLite when in fact sensitive information could leave the device or be processed by third parties.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The AI link analysis feature is documented as analyzing submitted URLs without warning that the URL itself, fetched page content, or derived summaries may be sent to external AI or network services. This is dangerous because users may submit private, internal, or sensitive links believing analysis is local, potentially exposing confidential resources or metadata to third parties.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill advertises executable components with filesystem, database, and network capabilities but does not declare any explicit tool scope or permissions. This creates a transparency and containment gap: users or platforms may treat it as a simple note tool while it can read/write local data and communicate externally.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill promotes cloud sync and external integrations but does not clearly warn that user notes, todos, or related metadata may be transmitted to third-party platforms. In a note-taking context, that omission is significant because captured ideas may contain sensitive personal, business, or credential-like information.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: Flask==3.0.0 — 2 advisory(ies): CVE-2026-27205 (Flask session does not add `Vary: Cookie` header when accessed in some ways); CVE-2026-27205 (Flask is a web server gateway interface (WSGI) web application framework. In ver)

Medium

• Category: Supply Chain
• Confidence: 97% confidence

Finding

Pinning Flask to 3.0.0 matches a version with published advisories, including a session/Vary: Cookie handling issue that can affect caching behavior and potentially expose one user's session-dependent content to another through shared caches. In a web-facing skill, depending on how Flask sessions and intermediaries are used, this can weaken confidentiality and correctness of authenticated or personalized responses.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: requests==2.31.0 — 6 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func) +3 more

Medium

• Category: Supply Chain
• Confidence: 98% confidence

Finding

Pinning requests to 2.31.0 matches multiple known advisories, including credential leakage through malicious URLs and TLS/session verification edge cases. Since this skill is described as an idea capture tool and may plausibly make outbound HTTP requests, a vulnerable HTTP client increases risk of secret disclosure, man-in-the-middle exposure, or unsafe handling of attacker-controlled URLs.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/ai_service.py (reported line 18)May include surrounding context.

python

# 小小爪 API 配置
XIAOXIAOZHAO_CONFIG = {
    "base_url": "https://api.minimaxi.com/anthropic/v1",
    "api_key": "YOUR_MINIMAX_API_KEY",
    "model": "MiniMax-M2.5"
}

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest frames the skill as a 'simple and elegant idea capture tool', which suggests lightweight note capture and organization. This file adds two broader behaviors: sending user content to a third-party AI API for expansion and fetching arbitrary URLs for content extraction and analysis, which materially exceeds plain capture functionality.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

User-provided content and fetched web content are transmitted to a third-party AI API without any visible consent, minimization, or redaction controls in this module. This can expose sensitive notes, links, or fetched page contents to an external processor, creating confidentiality and privacy risk.

Content

No source excerpt is available for this finding.