Is iamngoni/inkdrop safe?
Yes. iamngoni/inkdrop is safe to install. Oathe's behavioral security audit gave the inkdrop skill by iamngoni a trust score of 82/100 with 4 findings (2 high).
https://github.com/openclaw/skills/tree/main/skills/iamngoni/inkdrop
Is iamngoni/inkdrop safe to install?
This Inkdrop integration skill provides legitimate functionality for managing notes via the local Inkdrop HTTP API. However, the included shell script contains multiple command injection vulnerabilities that could be exploited if an attacker can control the input parameters.
What security issues were found in iamngoni/inkdrop?
Category Scores
Findings (4)
HIGH Command injection in search function -30 ▶
The search function uses unsanitized user input ($*) directly in a shell command substitution, allowing potential command injection attacks.
HIGH Python code injection in create/update functions -25 ▶
Variables $TITLE and $BODY are directly interpolated into Python code blocks using triple quotes, allowing potential Python code injection if these variables contain malicious content.
MEDIUM Unsafe shell parameter handling -15 ▶
Multiple shell script functions use user-provided parameters without proper sanitization or validation, creating potential attack vectors.
LOW Credential requirement for local API -10 ▶
Script requires INKDROP_AUTH credentials, but this is for legitimate local Inkdrop API access only.
Should I install iamngoni/inkdrop?
Oathe's verdict for iamngoni/inkdrop is SAFE with a trust score of 82/100. Recommendation: Install with caution.