evernote-sdk-patterns
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The documentation references the official Evernote SDK repository on GitHub (
github.com/Evernote/evernote-sdk-js), which is a well-known service. - [DATA_EXFILTRATION]: The implementation guide provides patterns using the Node.js
fsmodule to read local files for the purpose of uploading them as note attachments to the Evernote API. - [INDIRECT_PROMPT_INJECTION]: The skill defines patterns that process data from local files and the Evernote API, creating a surface for potential indirect prompt injection.
- Ingestion points: File paths in attachment functions, search queries in the search builder, and note metadata returned from the API.
- Boundary markers: The code samples do not implement specific boundary delimiters for untrusted data processed from the API or files.
- Capability inventory: The patterns utilize file system read access (
fs.readFileSync) and network capabilities via the Evernote SDK. - Sanitization: Inputs such as search terms and tag names are incorporated into API calls using string concatenation without significant validation or escaping.
Audit Metadata