Security audit

Screenote

Security checks for vulnerabilities and agentic risk

Overview

This skill performs disclosed Screenote screenshot upload, feedback retrieval, and comment workflows with clear limits and no hidden install or background behavior.

Install only if you expect your agent to send screenshots of your app pages to Screenote and to read or comment on Screenote annotations using your existing CLI authentication. Review the broad feedback trigger behavior if you run many skills with overlapping names.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (17)

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The workflow performs live state-changing operations against the Screenote service, including screenshot creation and comment addition, despite being described as a verifier-oriented module. In an analysis or verification context, automatically creating artifacts or posting comments can modify remote data unexpectedly, causing integrity issues, spam, audit noise, or unintended actions in a real tenant if invoked with valid credentials.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The module docstring frames the code as 'offline verification,' but the implementation issues live CLI commands that create screenshots and add comments remotely. This mismatch is dangerous because operators, reviewers, or higher-level agents may rely on the description and run the module in contexts where side effects are prohibited, leading to unintended remote changes under trusted credentials.

Vague Triggers

Medium

Confidence: 96% confidence
Finding: The trigger example using just "feedback" is overly generic and can match common user utterances unrelated to this skill. In an agent environment, broad activation phrases increase the chance of accidental invocation, causing the skill to intercept requests it was not intended to handle and potentially expose or operate on stored review data unexpectedly.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The feedback trigger set includes broad natural-language examples like "Show me the annotations" and "desktop feedback," which lack strong scope constraints and can overlap with normal conversation or other tools' domains. This makes unintended routing more likely, especially in multi-skill systems where generic UX and review terminology is common.

Ssd 3

High

Confidence: 99% confidence
Finding: The skill description explicitly states it can 'publish private local files through the Screenote JSON CLI,' which describes data exfiltration behavior rather than a normal screenshot-only capability. Because this is presented as a first-class feature in a skill package, it materially increases the risk that an agent using the skill could disclose sensitive local files to an external service or endpoint.

Skill Enumeration

Medium

Category: Agent Snooping
Content: # feedback Load and follow the canonical skill at [skills/feedback/SKILL.md](../../../skills/feedback/SKILL.md). That in-package file is the behavioral authority. Resolve its agents, scripts, references, context, and output paths relative to this plugin package or the invocation working directory exactly as the canonical skill specifies.
Confidence: 79% confidence
Finding: The duplicated finding points to the same risky delegation pattern: the package defers execution semantics to a separate markdown file and resolves related resources relative to plugin or working-directory context. That broad path-resolution instruction increases the chance of loading unintended local content or bypassing package-level review controls if the environment is manipulated.

Skill Enumeration

Medium

Category: Agent Snooping
Content: # feedback Load and follow the canonical skill at [skills/feedback/SKILL.md](../../../skills/feedback/SKILL.md). That in-package file is the behavioral authority. Resolve its agents, scripts, references, context, and output paths relative to this plugin package or the invocation working directory exactly as the canonical skill specifies.
Confidence: 79% confidence
Finding: The duplicated finding points to the same risky delegation pattern: the package defers execution semantics to a separate markdown file and resolves related resources relative to plugin or working-directory context. That broad path-resolution instruction increases the chance of loading unintended local content or bypassing package-level review controls if the environment is manipulated.

Skill Enumeration

Medium

Category: Agent Snooping
Content: # screenote Load and follow the canonical skill at [skills/screenote/SKILL.md](../../../skills/screenote/SKILL.md). That in-package file is the behavioral authority. Resolve its agents, scripts, references, context, and output paths relative to this plugin package or the invocation working directory exactly as the canonical skill specifies.
Confidence: 86% confidence
Finding: Although duplicated, this finding points to the same delegated-authority pattern: the package tells the agent that another file is the 'behavioral authority' and to follow it exactly. That design makes the skill more dangerous in context because the visible package wrapper is minimal while the actual behavior may include sensitive operations, reducing transparency and increasing the chance of hidden exfiltration or unsafe execution paths.

Skill Enumeration

Medium

Category: Agent Snooping
Content: # screenote Load and follow the canonical skill at [skills/screenote/SKILL.md](../../../skills/screenote/SKILL.md). That in-package file is the behavioral authority. Resolve its agents, scripts, references, context, and output paths relative to this plugin package or the invocation working directory exactly as the canonical skill specifies.
Confidence: 86% confidence
Finding: Although duplicated, this finding points to the same delegated-authority pattern: the package tells the agent that another file is the 'behavioral authority' and to follow it exactly. That design makes the skill more dangerous in context because the visible package wrapper is minimal while the actual behavior may include sensitive operations, reducing transparency and increasing the chance of hidden exfiltration or unsafe execution paths.

Skill Enumeration

Medium

Category: Agent Snooping
Content: # snapshot Load and follow the canonical skill at [skills/snapshot/SKILL.md](../../../skills/snapshot/SKILL.md). That in-package file is the behavioral authority. Resolve its agents, scripts, references, context, and output paths relative to this plugin package or the invocation working directory exactly as the canonical skill specifies.
Confidence: 90% confidence
Finding: The duplicated finding points to the same risky pattern: delegating authority to an external canonical skill and resolving dependent resources relative to package or invocation context. This broad trust in referenced content increases attack surface because behavior may differ from what this wrapper alone appears to allow, especially if an attacker can influence package contents or working-directory layout.

Skill Enumeration

Medium

Category: Agent Snooping
Content: # snapshot Load and follow the canonical skill at [skills/snapshot/SKILL.md](../../../skills/snapshot/SKILL.md). That in-package file is the behavioral authority. Resolve its agents, scripts, references, context, and output paths relative to this plugin package or the invocation working directory exactly as the canonical skill specifies.
Confidence: 90% confidence
Finding: The duplicated finding points to the same risky pattern: delegating authority to an external canonical skill and resolving dependent resources relative to package or invocation context. This broad trust in referenced content increases attack surface because behavior may differ from what this wrapper alone appears to allow, especially if an attacker can influence package contents or working-directory layout.

Skill Enumeration

Medium

Category: Agent Snooping
Content: # feedback Load and follow the canonical skill at [skills/feedback/SKILL.md](../../../skills/feedback/SKILL.md). That in-package file is the behavioral authority. Resolve its agents, scripts, references, context, and output paths relative to this plugin package or the invocation working directory exactly as the canonical skill specifies.
Confidence: 84% confidence
Finding: This duplicate finding refers to the same delegation at line 13, where the package directs the agent to load another skill file as authoritative. Such indirection can disclose internal skill structure and create a path-based control point for behavior, increasing risk when the skill's stated purpose includes access to potentially sensitive visual data.

Skill Enumeration

Medium

Category: Agent Snooping
Content: # feedback Load and follow the canonical skill at [skills/feedback/SKILL.md](../../../skills/feedback/SKILL.md). That in-package file is the behavioral authority. Resolve its agents, scripts, references, context, and output paths relative to this plugin package or the invocation working directory exactly as the canonical skill specifies.
Confidence: 84% confidence
Finding: This duplicate finding refers to the same delegation at line 13, where the package directs the agent to load another skill file as authoritative. Such indirection can disclose internal skill structure and create a path-based control point for behavior, increasing risk when the skill's stated purpose includes access to potentially sensitive visual data.

Skill Enumeration

Medium

Category: Agent Snooping
Content: # screenote Load and follow the canonical skill at [skills/screenote/SKILL.md](../../../skills/screenote/SKILL.md). That in-package file is the behavioral authority. Resolve its agents, scripts, references, context, and output paths relative to this plugin package or the invocation working directory exactly as the canonical skill specifies.
Confidence: 90% confidence
Finding: This duplicated finding points to the same risky delegation mechanism: the file tells the agent to treat another markdown file as the behavioral authority and to resolve linked resources relative to mutable filesystem locations. In a security review context, that indirection makes the wrapper more dangerous because the actual behavior is hidden from the current file and may vary based on environment or repository contents.

Skill Enumeration

Medium

Category: Agent Snooping
Content: # screenote Load and follow the canonical skill at [skills/screenote/SKILL.md](../../../skills/screenote/SKILL.md). That in-package file is the behavioral authority. Resolve its agents, scripts, references, context, and output paths relative to this plugin package or the invocation working directory exactly as the canonical skill specifies.
Confidence: 90% confidence
Finding: This duplicated finding points to the same risky delegation mechanism: the file tells the agent to treat another markdown file as the behavioral authority and to resolve linked resources relative to mutable filesystem locations. In a security review context, that indirection makes the wrapper more dangerous because the actual behavior is hidden from the current file and may vary based on environment or repository contents.

Skill Enumeration

Medium

Category: Agent Snooping
Content: # snapshot Load and follow the canonical skill at [skills/snapshot/SKILL.md](../../../skills/snapshot/SKILL.md). That in-package file is the behavioral authority. Resolve its agents, scripts, references, context, and output paths relative to this plugin package or the invocation working directory exactly as the canonical skill specifies.
Confidence: 91% confidence
Finding: The wrapper explicitly tells the agent to 'load and follow' another skill file and to resolve related resources relative to the package or invocation working directory. In a security-sensitive environment, this indirection can let an attacker influence what content is loaded from adjacent directories or the current working directory, making the skill more dangerous than a self-contained static document.

Skill Enumeration

Medium

Category: Agent Snooping
Content: # snapshot Load and follow the canonical skill at [skills/snapshot/SKILL.md](../../../skills/snapshot/SKILL.md). That in-package file is the behavioral authority. Resolve its agents, scripts, references, context, and output paths relative to this plugin package or the invocation working directory exactly as the canonical skill specifies.
Confidence: 91% confidence
Finding: The wrapper explicitly tells the agent to 'load and follow' another skill file and to resolve related resources relative to the package or invocation working directory. In a security-sensitive environment, this indirection can let an attacker influence what content is loaded from adjacent directories or the current working directory, making the skill more dangerous than a self-contained static document.

Static analysis

No suspicious patterns detected.