bear-notes
Pass
Audited by Gen Agent Trust Hub on Jul 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONCREDENTIALS_UNSAFEPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs the
grizzlyCLI tool from a third-party GitHub repository (github.com/tylerwince/grizzly) during the setup process. - [COMMAND_EXECUTION]: The skill uses shell commands to invoke the
grizzlybinary for creating, reading, and searching notes. - [CREDENTIALS_UNSAFE]: The skill references and uses a Bear API token stored at a fixed path in the user's home directory (
~/.config/grizzly/token). - [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it retrieves and processes content from Bear notes that could contain malicious instructions.
- Ingestion points: Content is read into the agent's context via
grizzly open-note,grizzly tags, andgrizzly open-tagcommands. - Boundary markers: There are no boundary markers or instructions to ignore embedded commands within the notes being processed.
- Capability inventory: The skill has the ability to write to the file system (modifying Bear's database via the CLI) and execute subprocesses.
- Sanitization: No sanitization or content validation is performed on the data retrieved from Bear notes before processing.
Audit Metadata