Security audit

siyuan-task-skill

Security checks for vulnerabilities and agentic risk

Overview

The skill fits its SiYuan task-management purpose, but it ships a concrete API token and exposes broad data-changing SiYuan access that users should review before installing.

Review before installing. Remove and rotate the shipped SiYuan token, replace config.env with your own endpoint and token, prefer HTTPS or a verified local-only endpoint, and use a token scoped as narrowly as SiYuan permits. Be careful with delete, migrate, and direct SiYuanClient usage because they can permanently change or remove notes outside ordinary task updates.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: config.env:4
Finding: Hardcoded SiYuan API Credential in Distributed Configuration
Content: View full analysis
`. 4. The attacker invokes any endpoint permitted by that token, potentially including notebook queries, document modification, file operations, asset uploads, and deletion operations. ### Impact Assessment The exact impact depends on server-side token permissions and network reachability. Based on the API operations implemented by the Skill, a compromised token could potentially permit: - Reading task, document, block, and notebook metadata. - Creating or modifying task rows and documents. - Renaming or deleting documents. - Uploading files into SiYuan assets. - Reading or writing SiYuan data files accepted by the API. - Executing arbitrary SQL queries supported by SiYuan's query endpoint. This can compromise the confidentiality, integrity, and availability of the affected SiYuan instance. ]]>
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/siyuan_api.py:45
Finding: API Token and User Data Transmitted over Unencrypted HTTP
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/siyuan_api.py:67
Finding: Generic API Client Exposes Capabilities Beyond Task Management
Content: View full analysis
Remediation: View remediation
.json ``` 5. Validate that the AV identifier originates from trusted configuration and reject traversal sequences, alternate directories, and unrelated filenames. 6. Make low-level methods private and expose only task-specific operations through `TaskManager`. 7. Place maintenance or migration functionality behind explicit user confirmation. 8. Use a separate, more restricted credential for normal task operations and reserve broader maintenance authority for an explicitly invoked administrative workflow. 9. Where supported, enforce notebook- and endpoint-level restrictions on the SiYuan server rather than relying exclusively on client-side checks. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (21)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The skill is presented as task management for a specific SiYuan workflow, but its documented capabilities include direct access to low-level APIs such as arbitrary SQL queries and broad document/block operations. That mismatch is dangerous because an invoking agent or user may grant trust based on the narrow description while the skill can actually read, modify, or delete unrelated SiYuan content and metadata well beyond task records.
Content: No source excerpt is available for this finding.

Lp1

High

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: This module performs authenticated HTTP requests to a local or remote SiYuan API, but the capability is not reflected in the declared permissions. Undeclared network access is dangerous because it hides a powerful communication channel that can read, modify, and delete user data through the API without transparent user consent.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The sql_query method accepts an arbitrary SQL statement and forwards it directly to the SiYuan API. In a task-management skill, this enables unrestricted querying of internal note data outside the declared scope and can be abused to enumerate or extract unrelated sensitive content.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The get_file and put_file methods provide direct access to arbitrary paths in the SiYuan data directory, including write capability. For a task-tracking skill, this is excessive and dangerous because it can overwrite configuration, content, or metadata unrelated to tasks, causing data corruption or unauthorized access.
Content: No source excerpt is available for this finding.

Lp1

High

Category: MCP Least Privilege
Confidence: 96% confidence
Finding: The code writes to local files, notably rewriting config.env and updating SiYuan internal AV JSON files via get_file/put_file. Undeclared file-write behavior is dangerous because it allows persistent local state changes outside the expected task-management surface, creating opportunities for configuration tampering, corruption, or destructive side effects.
Content: No source excerpt is available for this finding.

Lp1

High

Category: MCP Least Privilege
Confidence: 96% confidence
Finding: The code writes to local files, notably rewriting config.env and updating SiYuan internal AV JSON files via get_file/put_file. Undeclared file-write behavior is dangerous because it allows persistent local state changes outside the expected task-management surface, creating opportunities for configuration tampering, corruption, or destructive side effects.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The delete operation permanently removes both the associated sub-document and the database row immediately, with no confirmation, dry-run, soft-delete, or recovery path. In an agent context, a mistaken task identifier, prompt misunderstanding, or malicious prompt injection could cause irreversible loss of user notes and task records.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The activation guidance says to use the skill when the user mentions SiYuan, task management, or tracking work items, which is broad enough to trigger on many ordinary productivity requests. Because the skill has network access and indirectly exposes powerful content-management functions, overly broad routing increases the chance it is invoked in contexts where the user did not intend SiYuan API access or repository-backed automation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This code reads SIYUAN_API_TOKEN from configuration and uses it to authenticate outbound HTTP requests, but there is no visible confirmation prompt, logging, or explanatory warning in the file about handling credentials or transmitting authenticated data. Under the code-file criteria, access to sensitive credentials and network transmission should have some form of user disclosure unless already clearly warned elsewhere.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The client exposes broad notebook, document, block, asset, and file-management primitives that go well beyond the stated purpose of managing tasks in a specific task list document. This overbroad interface increases the blast radius of any misuse, prompt injection, or downstream bug, allowing modification or deletion of unrelated SiYuan content.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The remove_doc, remove_doc_by_id, and later delete_block methods invoke remote deletion endpoints that can remove user content, but the file provides no confirmation prompt, warning comment, or other disclosure about the destructive effect. These are safety-critical irreversible operations and meet the missing-warning criteria for code files.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This code implements authenticated remote file writes into the SiYuan data directory with no user-facing indication at the client layer that arbitrary persistent data will be modified. In the context of an overprivileged task skill, that lack of transparency makes stealthy corruption or unauthorized changes easier if the capability is misused.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The initialization path does more than manage tasks: it rewrites the local config.env file and changes persistent configuration for future runs. This expands the skill's side effects beyond its stated purpose and can surprise users or downstream tooling that assumes it only manipulates SiYuan task data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Database initialization silently rewrites config.env, removing and replacing AV_/COL_ entries without any confirmation, backup, or warning. This can overwrite existing configuration, disrupt other components that rely on the file, and create persistent misconfiguration from a single command invocation.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill directly reads and rewrites SiYuan's internal AV JSON storage to bind rows to documents instead of using stable public APIs. Direct manipulation of internal storage is brittle and dangerous because malformed writes or version mismatches can corrupt application metadata, break task links, or cause broader integrity issues in the note database.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 99% confidence
Finding: This configuration file exposes a private service endpoint and a live API token in plaintext, enabling unauthorized access to the user's SiYuan instance if the file is leaked, shared, or committed to source control. In the context of a task-management skill, that access could allow reading, modifying, or deleting notes and task data, so the hard-coded endpoint is not merely a policy issue here because it is paired with usable authentication material.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: This markdown file describes notebook creation, rename, and removal endpoints, including a deletion operation, but does not include any user warning about the risk of modifying or deleting user data. Under the markdown-file criteria, descriptions should warn when behavior can affect user data or system integrity.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The reference lists document creation, rename, and removal endpoints, and later block update/delete/move operations, without any warning that these calls can alter or permanently remove user content. For markdown skill documentation, operations affecting user data should be accompanied by a clear caution.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 72% confidence
Finding: The SQL section shows how to query note content, attributes, and references, including content searches, but provides no warning that queries may expose sensitive user data. Markdown descriptions should disclose privacy-impacting behaviors when they can access broad user content.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The Asset section documents multipart file upload behavior but does not warn that local file contents will be transmitted to the SiYuan API and stored as assets. This is a user-data affecting behavior that should be disclosed in markdown documentation.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The manifest presents the skill as managing tasks and related materials, but migrate and bind_all_detached implement database schema cleanup, column removal, reordering, and bulk repair of detached rows. These administrative maintenance actions go beyond normal end-user task operations described in the manifest.
Content: No source excerpt is available for this finding.