The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The application authentication token is transmitted as a plaintext query parameter in every network request to the Joplin API, which may lead to exposure in logs or network monitoring.
Evidence: In scripts/joplin_tool.py, the JoplinClient._request method explicitly adds the token to the params dictionary, which is then used in the httpx.request call as URL query parameters.
[DATA_EXFILTRATION]: The skill contains features that read arbitrary local files and upload their contents to the Joplin API, providing a mechanism that could be misused for data exfiltration.
Evidence: The note create and note update commands in scripts/joplin_tool.py implement a --body-from flag that reads file content using Path(body_from).read_text(). The resource upload command also reads local files via open(file_path, "rb") for transmission.
[INDIRECT_PROMPT_INJECTION]: The skill ingests notes and resource metadata from the Joplin database, creating a vulnerability surface where malicious instructions stored in notes could potentially override agent behavior.
Ingestion points: The list_notes, get_note, and search functions in scripts/joplin_tool.py fetch note bodies and titles from the API.
Boundary markers: There are no explicit delimiters or instructions provided to the agent to treat the retrieved content as untrusted data.
Capability inventory: The skill possesses file-read and file-write capabilities (via resource upload and resource download) as well as network access.
Sanitization: Content retrieved from the API is passed directly to the agent's context without filtering or validation.

joplin