Security audit

ima-skill

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent IMA notes and knowledge-base integration, but it handles private notes, credentials, document access links, and write operations with several under-scoped or under-disclosed behaviors users should review carefully.

Install only if you are comfortable granting the skill access to your IMA notes and knowledge bases. Prefer environment variables or a secure secret manager over plaintext ~/.config/ima credential files, avoid setting IMA_BASE_URL unless you fully trust the endpoint, and confirm before allowing any note creation, append, upload, export, or original-document retrieval.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Context-Inappropriate Capability

Medium

Confidence: 83% confidence
Finding: The skill instructs users to store API credentials in local files under ~/.config/ima and to read them during operation. While this is framed as setup guidance, it expands the skill’s behavior into credential handling beyond its core notes/knowledge-base purpose, increasing the chance of accidental exposure through weak file permissions, shell history, or unintended reuse by other local processes.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The trigger conditions are very broad, including ordinary phrases like '帮我记一下' and general references to personal document access, which can cause the skill to activate in many ambiguous contexts. Over-broad routing raises the risk of the agent invoking a credentialed skill unnecessarily, leading to unintended note creation, retrieval, or knowledge-base actions on sensitive user data.

Missing User Warnings

Medium

Confidence: 83% confidence
Finding: The documentation explicitly instructs callers to retrieve original-media access URLs and to reuse any returned authentication headers when requesting the content. Those URLs and headers may function as bearer-style access tokens to private user documents, so surfacing or mishandling them can expose sensitive knowledge-base contents beyond the intended trust boundary. In this skill context, which handles personal notes and knowledge-base files, the privacy sensitivity makes the issue more dangerous.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The trigger phrases for note search are broad enough to match ordinary conversational requests like '搜索' or '找…', which can cause the skill to activate when the user did not clearly intend a note search. In a privacy-sensitive notes skill, unintended invocation can expose notebook metadata or facilitate retrieval of personal note content through ambiguous prompts.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: Creation triggers such as '创建笔记' and especially broader phrases like '生成笔记' or '把这段内容保存为笔记' may cause accidental write operations from loosely related user requests. Because this skill can persist user content, overbroad write-triggering increases the risk of unintended data creation, storage of sensitive content, or confusing state changes without clear consent.

Vague Triggers

Low

Confidence: 78% confidence
Finding: Phrases like '有哪些分类' or '查看目录' are ambiguous and may refer to many non-note contexts, yet they can trigger enumeration of notebook structures. Even if content is not immediately shown, exposing notebook names and hierarchy can leak sensitive personal organization metadata in a privacy-oriented skill.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: ima_api.cjs:31