Screenote

The workflow performs live state-changing operations against the Screenote service, including screenshot creation and comment addition, despite being described as a verifier-oriented module. In an analysis or verification context, automatically creating artifacts or posting comments can modify remote data unexpectedly, causing integrity issues, spam, audit noise, or unintended actions in a real tenant if invoked with valid credentials.

The module docstring frames the code as 'offline verification,' but the implementation issues live CLI commands that create screenshots and add comments remotely. This mismatch is dangerous because operators, reviewers, or higher-level agents may rely on the description and run the module in contexts where side effects are prohibited, leading to unintended remote changes under trusted credentials.

The trigger example using just "feedback" is overly generic and can match common user utterances unrelated to this skill. In an agent environment, broad activation phrases increase the chance of accidental invocation, causing the skill to intercept requests it was not intended to handle and potentially expose or operate on stored review data unexpectedly.

The feedback trigger set includes broad natural-language examples like "Show me the annotations" and "desktop feedback," which lack strong scope constraints and can overlap with normal conversation or other tools' domains. This makes unintended routing more likely, especially in multi-skill systems where generic UX and review terminology is common.

The skill description explicitly states it can 'publish private local files through the Screenote JSON CLI,' which describes data exfiltration behavior rather than a normal screenshot-only capability. Because this is presented as a first-class feature in a skill package, it materially increases the risk that an agent using the skill could disclose sensitive local files to an external service or endpoint.

The duplicated finding points to the same risky delegation pattern: the package defers execution semantics to a separate markdown file and resolves related resources relative to plugin or working-directory context. That broad path-resolution instruction increases the chance of loading unintended local content or bypassing package-level review controls if the environment is manipulated.

The duplicated finding points to the same risky delegation pattern: the package defers execution semantics to a separate markdown file and resolves related resources relative to plugin or working-directory context. That broad path-resolution instruction increases the chance of loading unintended local content or bypassing package-level review controls if the environment is manipulated.

Although duplicated, this finding points to the same delegated-authority pattern: the package tells the agent that another file is the 'behavioral authority' and to follow it exactly. That design makes the skill more dangerous in context because the visible package wrapper is minimal while the actual behavior may include sensitive operations, reducing transparency and increasing the chance of hidden exfiltration or unsafe execution paths.

Although duplicated, this finding points to the same delegated-authority pattern: the package tells the agent that another file is the 'behavioral authority' and to follow it exactly. That design makes the skill more dangerous in context because the visible package wrapper is minimal while the actual behavior may include sensitive operations, reducing transparency and increasing the chance of hidden exfiltration or unsafe execution paths.

The duplicated finding points to the same risky pattern: delegating authority to an external canonical skill and resolving dependent resources relative to package or invocation context. This broad trust in referenced content increases attack surface because behavior may differ from what this wrapper alone appears to allow, especially if an attacker can influence package contents or working-directory layout.

The duplicated finding points to the same risky pattern: delegating authority to an external canonical skill and resolving dependent resources relative to package or invocation context. This broad trust in referenced content increases attack surface because behavior may differ from what this wrapper alone appears to allow, especially if an attacker can influence package contents or working-directory layout.

This duplicate finding refers to the same delegation at line 13, where the package directs the agent to load another skill file as authoritative. Such indirection can disclose internal skill structure and create a path-based control point for behavior, increasing risk when the skill's stated purpose includes access to potentially sensitive visual data.

This duplicate finding refers to the same delegation at line 13, where the package directs the agent to load another skill file as authoritative. Such indirection can disclose internal skill structure and create a path-based control point for behavior, increasing risk when the skill's stated purpose includes access to potentially sensitive visual data.

This duplicated finding points to the same risky delegation mechanism: the file tells the agent to treat another markdown file as the behavioral authority and to resolve linked resources relative to mutable filesystem locations. In a security review context, that indirection makes the wrapper more dangerous because the actual behavior is hidden from the current file and may vary based on environment or repository contents.

This duplicated finding points to the same risky delegation mechanism: the file tells the agent to treat another markdown file as the behavioral authority and to resolve linked resources relative to mutable filesystem locations. In a security review context, that indirection makes the wrapper more dangerous because the actual behavior is hidden from the current file and may vary based on environment or repository contents.

The wrapper explicitly tells the agent to 'load and follow' another skill file and to resolve related resources relative to the package or invocation working directory. In a security-sensitive environment, this indirection can let an attacker influence what content is loaded from adjacent directories or the current working directory, making the skill more dangerous than a self-contained static document.

The wrapper explicitly tells the agent to 'load and follow' another skill file and to resolve related resources relative to the package or invocation working directory. In a security-sensitive environment, this indirection can let an attacker influence what content is loaded from adjacent directories or the current working directory, making the skill more dangerous than a self-contained static document.