bear-notes-hardened
Warn
Audited by Gen Agent Trust Hub on Apr 21, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill's configuration specifies the installation of a binary tool from an external GitHub repository (github.com/tylerwince/grizzly) using the Go package manager.
- [REMOTE_CODE_EXECUTION]: The installation process involves downloading and executing code from an unverified remote source, which could lead to arbitrary code execution if the source is compromised.
- [CREDENTIALS_UNSAFE]: The skill is designed to access a sensitive API token stored in the user's home directory at ~/.config/grizzly/token. Accessing such files is a sensitive operation involving credentials.
- [COMMAND_EXECUTION]: The skill relies on executing shell commands with arguments derived from potentially untrusted inputs, such as note IDs and note content.
- [PROMPT_INJECTION]: The instructions include defensive prompts designed to restrict agent behavior under specific conditions, such as requests for bulk data enumeration or token exposure.
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted data from Bear notes (via
grizzly open-notein SKILL.md) without boundary markers or sanitization, which could influence the agent's behavior through instructions embedded in the notes themselves.
Audit Metadata