Agent Economy ReportAgent Economy ReportCAUTION version 2.0.4 · audited 2026-09-17
This package is a set of agent instructions for operating the GetNote note service through the official `getnote` CLI. It installs the `@getnote/cli` npm package when missing, authenticates the user through a browser page, and then saves, searches, reads, organizes, tags, shares, updates, and deletes notes in the user's authorized account. The instructions require exit-code and JSON success checks and ask for confirmation before destructive actions, and they state that the skill does not collect or display full credentials. The main concerns are that it delegates broad account access and local credential storage to an unpinned external npm CLI, and that `getnote setup` can synchronize local skills. No hidden network destinations, obfuscated code, or credential exfiltration were observed.
| Declared purpose | 通过官方 getnote CLI 连接得到大脑，完成浏览器授权、连接诊断、CLI 升级，以及保存、查询、搜索、整理和管理用户的真实笔记。 |
| Observed behavior | The package files are markdown instructions rather than standalone executable code. They direct an agent to install @getnote/cli through the platform when the getnote binary is missing, run getnote setup/auth login/doctor, and then use getnote commands for saving, listing, searching, reading, updating, tagging, sharing, and deleting notes and knowledge-base items. Long content may be read from local files or stdin, and the CLI performs network calls and stores login credentials locally. The instructions repeatedly require checking exit codes and success fields, preserving string IDs, and confirming destructive actions. |
| Verdict, rules only | SAFE |
| Verdict, AI | CAUTION |
| Final verdict | CAUTION (never better than either pass) |
| capability | vs purpose | detail |
|---|---|---|
| network | needed | The skill instructs the agent to run getnote commands that access the GetNote API; SKILL.md line 24 says the official API reads or modifies authorized account data. |
| shell | needed | The core behavior is executing getnote CLI commands and reading their JSON output; SKILL.md line 85 says all real operations are completed by the official getnote CLI. |
| filesystem_read | needed | Saving images uses user-provided local image paths, and long text may be passed with --content-file or --stdin (references/note.md lines 45 and 57). |
| filesystem_write | needed | The external CLI stores authorization information in its local config directory (SKILL.md line 25), and getnote setup can synchronize local domain skills (SKILL.md line 46). |
| credentials | needed | The skill handles browser authorization and local credential storage, but tells the agent not to request API keys, cookies, or Authorization, and not to display full credentials (SKILL.md lines 25 and 47). |
| install_packages | needed | The frontmatter declares installation of the npm package @getnote/cli when the getnote binary is missing (SKILL.md lines 9, 13, and 15). |
| browser | needed | Login uses getnote auth login to open a browser authorization page for the user to confirm (SKILL.md line 47). |
| severity | finding |
|---|---|
| medium | Installs external npm CLI package The frontmatter installs the GetNote CLI from npm with no version pin. This delegates command execution to an external package that a user should review before trusting. SKILL.md:13 package: "@getnote/cli" |
| medium | Broad account read/write access The skill is designed to read and modify real notes, knowledge bases, tags, shares, and subscriptions in the authorized GetNote account. SKILL.md:24 本 Skill 会按用户请求执行 `getnote` 命令，并通过得到大脑官方 API 读取或修改当前已授权账号的数据。 |
| info | Credentials stored locally by external CLI Browser login is used and the external CLI stores authorization data locally. The skill claims not to read, display, or forward full credentials. SKILL.md:25 登录会打开浏览器授权页，并由 CLI 把授权信息保存在其本机配置目录；Skill 不读取、展示或转发完整凭证。 |
| medium | getnote setup can synchronize local skills The external CLI may synchronize five domain skills on the local AI. The current standalone skill is excluded from being overwritten, but the operation still changes local skill content. SKILL.md:46 执行 `getnote setup`，让 CLI 检测本机 AI、同步五个领域 Skill 并引导授权。当前独立 Skill 仍由平台管理，CLI 不覆盖它。 |
| low | Claim inconsistent with getnote setup skill sync This line says the skill will not modify other Skill files, but getnote setup in line 46 synchronizes five domain skills. The scope of local changes should be reviewed. SKILL.md:27 只有用户明确要求升级时才执行 `getnote update`；不会自行运行 npm、安装其他软件、下载并覆盖本 Skill 或修改其他 Skill 文件。 |
| low | Update phrase treated as full authorization When the user says update GetNote, the skill proceeds with CLI upgrade, five-domain-skill sync, and diagnostics without asking the user to choose internal components. SKILL.md:104 用户说“更新得到大脑”已经构成完整更新授权，不再让用户选择内部组件： |
| info | Destructive actions require confirmation The instructions require confirmation before delete, overwrite, replace all tags, public share, and bulk remove actions. SKILL.md:89 删除、覆盖、替换全部标签、公开分享和批量移出必须先确认。 |
| medium | Publisher discloses supply-chain risk The skill card itself states the external npm CLI is unpinned and can make persistent local authorization and skill changes. skill-card.md:25 Risk: The release delegates installation, setup, and updates to an unpinned external npm CLI package that can make persistent local authorization and skill chan |
| info | Long note content may be read from files or stdin Saving long notes may use a local content file or standard input, meaning the agent may need filesystem access. references/note.md:45 短文本可作为参数传入。长文本、Markdown、含复杂引号或换行的内容必须使用 `--content-file` 或 `--stdin`，避免截断和转义损坏。 |
| info | Image save uses local file paths The skill instructs the agent to use the user-provided local image path, which requires reading a local file. references/note.md:57 使用本轮用户明确给出的本地图片路径，不把文件名保存成文字，也不带上历史图片。 |
0 AI finding(s) were dropped because their file, line or quote did not match the package.
| domain | service rating | where |
|---|---|---|
| clawhub.ai | not in the service index | skill-card.md:9 |
| www.npmjs.com | not in the service index | skill-card.md:40 |
| Binaries invoked | bash, node, npm |
| Environment variables read | none |
| Hard-coded wallets | none |
| Pipes a download to a shell | 0 |
| eval / exec / subprocess | 0 |
| base64 blobs | 0 |
| File writes | 1 |
| Persistence | 0 |
| file | lines | sha256 |
|---|---|---|
LICENSE | 21 | e4f2c00f20e17094… |
SKILL.md | 108 | d428979b9f3b9ce1… |
_meta.json | 6 | b3ebde5f7447305c… |
references/auth.md | 65 | 1841f2ffcc378473… |
references/kb.md | 85 | 8bd70c9757b40063… |
references/note.md | 109 | 9e2d05fe1a6cd3fc… |
references/search.md | 59 | 707690db243745dd… |
references/tag.md | 57 | 619ee0cd5f396842… |
skill-card.md | 63 | cfa511fac5d1dc6a… |
For agents
JSON: https://agenteconomy.report/k/getnote.audit.json · badge: https://agenteconomy.report/k/getnote.audited.svg ·
skill rating: /k/getnote · commission an audit of any skill: US$ 29 per version.
The complete published package of this exact version was downloaded from the registry and read statically; nothing was executed. A deterministic pass extracts network destinations, binaries, environment variables, writes, install commands, obfuscation markers, subprocesses and wallets, each with file and line. An AI then reads the whole package with those facts and writes the summary, the capabilities and the findings under a strict schema; every finding it produces must cite a file, a line and the exact text, or it is dropped. The final verdict is the worst of the two passes. The audit does not change the skill's trust tier (policy); the author may respond through the dispute channel and the response is published here. Commissioned by: the Agent Economy Report (free program: the 150 most downloaded skills, September 2026).