Security audit

ima-skill

Security checks for vulnerabilities and agentic risk

Overview

The skill largely matches its IMA notes and knowledge-base purpose, but it needs Review because it can treat remote update text as agent guidance and can redirect credential-bearing API calls away from the documented domain.

Review before installing. Use this only if you trust the publisher and the IMA account permissions. Protect the Client ID and API key with restrictive file permissions or a secret store, avoid putting secrets in command logs, do not set IMA_BASE_URL to a non-official endpoint, and treat any remote update instruction as untrusted informational text unless separately verified.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: ima_api.cjs:111
Finding: Remote Agent Instruction Hijacking Through Update Responses
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: ima_api.cjs:65
Finding: IMA Credentials Can Be Redirected to an Arbitrary Base URL
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:119
Finding: Long-Lived and Temporary Credentials Exposed in Process Arguments
Content: View full analysis
/tmp/ima_err); then ``` ```bash node .claude/skills/ima-skill/knowledge-base/scripts/cos-upload.cjs \ --file "/path/to/report.pdf" \ --secret-id "" \ --secret-key "" \ --token "" \ --bucket "" \ --region "" \ --cos-key "" \ --content-type "$CONTENT_TYPE" \ --start-time "" \ --expired-time "" \ --timeout 300000 ``` ### Technical Analysis The documented API invocation serializes the long-lived IMA Client ID and API key into an options JSON argument. The COS upload workflow similarly passes the temporary Secret ID, Secret Key, and security token as command-line arguments. Command-line arguments can be exposed through: - Process inspection interfaces and administrative tools. - Shell tracing or verbose execution. - Job runners and orchestration telemetry. - Crash diagnostics and process accounting. - Agent or CI logs that record invoked commands. Temporary COS credentials reduce the duration of exposure but do not remove the risk. The IMA API key is potentially long-lived and has broader access. ### Attack Path 1. The Agent follows the documented command template. 2. IMA or COS credentials are inserted into the child process argument vector. 3. A local user, privileged monitoring agent, process-accounting service, or command logger captures the proce ...[truncated 741 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:94
Finding: Credential Setup Does Not Enforce Restrictive File Permissions
Content: View full analysis
~/.config/ima/client_id echo "your_api_key" > ~/.config/ima/api_key ``` ### Technical Analysis The recommended setup writes long-lived credentials using the caller's current umask. It does not explicitly restrict permissions on either the configuration directory or credential files. On systems with permissive defaults, the directory may be traversable and the files may be readable by other local users. The implementation later reads these files as authentication material, so their confidentiality is security-critical. ### Attack Path 1. A user follows the documented credential setup instructions. 2. The shell operates with a permissive umask. 3. `~/.config/ima` or its credential files receive group-readable or world-readable permissions. 4. Another local account or process reads `client_id` and `api_key`. 5. The stolen credentials are replayed against the IMA API. ### Impact Assessment A local attacker may obtain the user's IMA identity and API key. The resulting remote privileges depend on the API account but may include reading private note metadata and content, browsing knowledge bases, and performing authorized write operations. The issue is limited to environments where another local principal can inspect the files and the effective permissions permit access. Nevertheless, explicit secret-file protection is required because the credentials are persistent and potentially long-lived. ]]>
Remediation: View remediation
"$HOME/.config/ima/client_id" printf '%s\n' "$API_KEY" > "$HOME/.config/ima/api_key" chmod 600 "$HOME/.config/ima/client_id" "$HOME/.config/ima/api_key" ``` Additional hardening measures: 1. Verify file ownership and permissions before reading credentials. 2. Reject symlinks and non-regular credential files. 3. Warn or fail if the directory or files are accessible by group or other users. 4. Prefer an operating-system credential manager or secret store where available. 5. Avoid including real credential values in shell history or copyable command examples. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (24)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill uses environment variables and network access but does not declare an explicit tool scope such as allowed-tools or permissions. That makes the skill's effective capabilities broader and less auditable, increasing the chance that a host agent grants more access than intended or routes sensitive user requests into this skill without clear boundaries.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The activation text is very broad and matches generic note-taking, memory, document storage, and knowledge-search requests, including vague phrases like '帮我记一下'. Overbroad triggers can cause the skill to activate for common conversations and route unrelated user content into external APIs, creating privacy and unintended-action risks.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.
md
1. **UTF-8 encoding (notes writes only):** Before calling `import_doc` or `append_doc`, ALL string fields (`content`, `title`) MUST be validated as legal UTF-8. Non-UTF-8 content causes irreversible garbled text. See [Detailed Rules](#detailed-utf-8-encoding-rules) for platform-specific methods. 2. **File upload naming:** `title` MUST equal `file_name` (with extension). Never rename, shorten, translate, or modify the original filename. 3. **Unsupported file types:** Reject immediately with a clear message. Do NOT ask user "do you still want to try?" Video files, Bilibili/YouTube URLs, and `file://` URLs are not supported — tell user to use IMA desktop client. 4. **File upload integrity:** Keep file content as-is during upload. No encoding conversion for binary files (PDF, images, Excel, etc.). 5. **PowerShell 5.1 (all modules):** If running in PowerShell, detect version before first API call. PS 5.1 silently converts request Body to GBK — must use UTF-8 byte array mode. See [Detailed Rules](#powershell-51-environment-detection).

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.
md
## 模块决策表 | 用户意图 | 模块 | 读取 | | ------------------------------------------------------------------------------------------ | -------------- | ------------------------- | | 搜索笔记、浏览笔记本、获取笔记内容、创建笔记、追加内容 | notes | `notes/SKILL.md` | | 上传文件、添加网页链接、搜索知识库、浏览知识库内容、获取知识库信息、获取可添加的知识库列表 | knowledge-base | `knowledge-base/SKILL.md` |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · notes/references/api.md (reported line 66)May include surrounding context.
md
## 模块决策表 | 用户意图 | 模块 | 读取 | | ------------------------------------------------------------------------------------------ | -------------- | ------------------------- | | 搜索笔记、浏览笔记本、获取笔记内容、创建笔记、追加内容 | notes | `notes/SKILL.md` | | 上传文件、添加网页链接、搜索知识库、浏览知识库内容、获取知识库信息、获取可添加的知识库列表 | knowledge-base | `knowledge-base/SKILL.md` |

Session Persistence

Medium

Category: Rogue Agent
Confidence: 90% confidence
Finding: The skill recommends persisting API credentials in plaintext files under ~/.config/ima. If the local machine, account, backups, logs, or other tools can access that directory, the credentials may be stolen and reused to access the user's IMA data or perform API actions as that user.
Content: Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.
方式 A — 配置文件（推荐）：

bash
mkdir -p ~/.config/ima echo "your_client_id" > ~/.config/ima/client_id echo "your_api_key" > ~/.config/ima/api_key

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This file emits user-facing messages in Chinese, and similar fixed-language strings appear elsewhere, without any opt-in or locale selection mechanism. That creates a natural-language policy issue under SQP-3 because the skill effectively forces a specific language for user-visible output.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The code sends client credentials in HTTP headers and transmits request bodies to a remote service via fetch, but this file provides no confirmation prompt, user-facing log, or comment/docstring warning that data and credentials will be sent over the network. For a code-file audit under SQP-2, this is a safety-relevant network operation lacking visible disclosure in the file.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill performs a remote self-update check and persists local state in ~/.config/ima/last_update_check, behavior that is outside the user-described note/knowledge-base operations. This expands the skill's effective capability surface and introduces an undeclared network call plus filesystem write, which can surprise users and create governance and integrity concerns if the update endpoint or response is abused.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Multiple user-visible messages, including update notices and input-validation errors, are hardcoded in Chinese in this file. Because no language choice or documented locale restriction is provided, the skill violates the language/locale guidance in SQP-3.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The skill content is written as an operational instruction set in Chinese and does not indicate that the user may choose another language or locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · knowledge-base/SKILL.md (reported line 7)May include surrounding context.
md
## 接口决策表 | 用户意图 | 调用接口 | 关键参数 | | --------------------------------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------- | | 上传文件到知识库 | `check_repeated_names` → `create_media` → COS Upload → `add_knowledge` | `media_type`（按扩展名），`knowledge_base_id`，`file_name`，`file_size` | | 上传文件到知识库的某个文件夹 | 先定位文件夹 → 同上（`folder_id` 传入目标文件夹 ID） | 见「文件夹操作」章节 |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · knowledge-base/references/api.md (reported line 154)May include surrounding context.
md
## 接口决策表 | 用户意图 | 调用接口 | 关键参数 | | --------------------------------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------- | | 上传文件到知识库 | `check_repeated_names` → `create_media` → COS Upload → `add_knowledge` | `media_type`（按扩展名），`knowledge_base_id`，`file_name`，`file_size` | | 上传文件到知识库的某个文件夹 | 先定位文件夹 → 同上（`folder_id` 传入目标文件夹 ID） | 见「文件夹操作」章节 |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · knowledge-base/references/api.md (reported line 156)May include surrounding context.
md
| 值 | 名称 | content_type / 说明 | | --- | -------------- | ------------------------------------------------------------------------------------------------------------- | | 1 | PDF | `application/pdf` | | 2 | 网页 | N/A（直接 AddKnowledge，`web_info.content_id=<url>`） | | 3 | Word | `application/msword` / `application/vnd.openxmlformats-officedocument.wordprocessingml.document` | | 4 | PPT | `application/vnd.ms-powerpoint` / `application/vnd.openxmlformats-officedocument.presentationml.presentation` |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · knowledge-base/references/api.md (reported line 166)May include surrounding context.
md
| 9 | 图片 | `image/png`, `image/jpeg`, `image/webp` | | 11 | 笔记 | N/A（直接 AddKnowledge，`note_info.content_id=<doc_id>`） | | 12 | AI会话 | N/A（直接 AddKnowledge，`session_info.content_id=<session_id>`） | | 13 | TXT | `text/plain` | | 14 | Xmind | `application/x-xmind` / `application/vnd.xmind.workbook` / `application/zip` | | 15 | 录音 | `audio/mpeg`(mp3), `audio/x-m4a`(m4a), `audio/wav`(wav), `audio/aac`(aac) | | 16 | 视频解析 | **不支持通过 skill 添加**。Bilibili/YouTube等仅支持在 ima 桌面端内添加进知识库 |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · knowledge-base/references/api.md (reported line 468)May include surrounding context.
md
#### 返回字段（`data` 内） | 字段 | 类型 | 说明 | | ------------------- | --------------- | ------------------------------------------------------------------------------------------------- | | `media_type` | int32 | 媒体类型（见 MediaType 枚举） | | `url_info` | URLInfo | 访问链接信息，非笔记类型时填写（见 [URLInfo](#urlinfo访问链接信息)） |

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The instruction says to directly display the API msg to the user, and throughout the file the documented response messages and instructions are in Chinese. This creates a language/locale constraint on user-facing output without any opt-in or alternative language path.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The skill’s operational description is written as a direct instruction in Chinese and does not indicate that the agent should adapt to the user’s preferred language. Under the policy rule, forcing a specific language or locale without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The trigger phrase for searching notes is broad enough to overlap with ordinary conversation such as generic 'search' or 'find' requests. In a privacy-sensitive note skill, this can cause unintended invocation and expose notebook metadata or note contents when the user did not clearly intend to access their notes.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The documentation describes create and append operations but does not clearly require a user-facing warning or confirmation before mutating stored notes. Because these are persistent write actions against private user data, lack of explicit confirmation increases the chance of silent data modification, accidental overwrites, or prompt-induced unauthorized persistence.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The create-note trigger includes broad phrases like saving content as a note without requiring strong confirmation or contextual constraints. This creates a risk of unintended writes to a user's private store, which can persist sensitive, incorrect, or manipulated content without the user's informed intent.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The natural-language instructions and trigger examples are written entirely in Chinese and frame activation around Chinese phrases, with no indication that other languages are supported or that the user can choose a language. This can be a locale/language policy issue when a skill implicitly constrains interaction language without opt-in or justification.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The manifest focuses on user intents around notes, uploads, and knowledge-base access, but does not mention credential discovery from process environment or ~/.config/ima files. While remote API access may require authentication, this specific capability is not justified by the stated purpose as written and expands the skill’s access to host-local sensitive configuration.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: The function writes a timestamp file under the user's home directory (~/.config/ima/last_update_check), but there is no user-facing notice, prompt, or explanatory docstring/comment disclosing that persistent local state will be created. This matches SQP-2's concern for file writes in code files when no disclosure is present.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: ima_api.cjs:31