bear-notes
Warn
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill recommends installing a Go binary from a non-trusted GitHub repository (github.com/tylerwince/grizzly). This allows third-party code to be installed on the system that is not from a well-known or verified vendor.
- [INDIRECT_PROMPT_INJECTION]: The skill allows the agent to read and search note content from the Bear app, creating a vulnerability surface where malicious instructions embedded in notes could influence the agent's behavior.
- Ingestion points: Note content is read via grizzly read or grizzly search into the agent context.
- Boundary markers: There are no markers or warnings to the model to ignore instructions contained within the fetched note content.
- Capability inventory: The agent has access to Bash, Read, and Write tools, which provide a significant capability set if an injection attack is successful.
- Sanitization: No sanitization or filtering of note content is performed before processing.
Audit Metadata