Zettelkasten note tool

Create, manage, and operate a Zettelkasten slip-box note system using the zk.py CLI script. Use this skill whenever a user wants to build or use a Zettelkast...

This skill appears to do what it says: manage a local Zettelkasten vault and needs only optional ZK_VAULT and EDITOR environment variables. Before installing or running it: - Review the script yourself (it is provided) and run it from a user account you control. The code is local-file oriented and does not phone home. - Be cautious with the EDITOR environment variable: the script uses os.system(f'{editor} "{path}"'). If EDITOR is set to a malicious string (or contains shell metacharacters), that could execute undesired shell commands. Prefer setting EDITOR to a trusted program (e.g., vim, nano) or modify the script to use subprocess.run([...], shell=False). - Be mindful of ZK_VAULT: if you override the vault path, the tool will scan and read all .md files under that path. Don’t point it at directories containing sensitive files. - If you plan to allow autonomous invocation by an agent, consider whether automatic file creation/editing is acceptable; you can require explicit user invocation instead. - If you want extra safety, run the script in a confined environment (different user account, container, or VM) until you’re comfortable with behavior.

Type: OpenClaw Skill Name: znote Version: 1.0.0 The znote skill provides a functional Zettelkasten note-taking CLI tool. However, the script 'scripts/zk.py' contains a shell injection vulnerability in the '_open_in_editor' function, which uses 'os.system()' to execute a command string constructed from the 'EDITOR' environment variable and a file path. While the file paths are sanitized using a slugification function, the reliance on 'os.system' for executing external commands is a high-risk practice that could be exploited if the environment is compromised. No evidence of intentional malice, data exfiltration, or prompt injection was found.