bear-notes
Warn
Audited by Gen Agent Trust Hub on Jul 16, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill's metadata includes an installation step for the grizzly CLI tool from a third-party GitHub repository (github.com/tylerwince/grizzly) using go install. This repository is not maintained by a recognized trusted vendor or the skill author.
- [COMMAND_EXECUTION]: The skill instructions direct the agent to execute shell commands using the grizzly binary to interact with the local Bear application on macOS.
- [PROMPT_INJECTION]: The skill processes content from Bear notes, which are external data sources that could contain malicious instructions intended to influence the agent's behavior.
- Ingestion points: Note content and tags are retrieved into the agent's context through grizzly open-note and open-tag commands.
- Boundary markers: The instructions do not provide explicit delimiters or warnings to the agent to treat note content as untrusted data.
- Capability inventory: The agent is granted capabilities to read, create, and modify notes, and it can access the local file system through command arguments (e.g., token-file paths).
- Sanitization: There is no evidence of filtering or sanitization of note content before it is processed by the agent.
Audit Metadata