quick-note-tool

Fast note-taking and snippet storage. Use when user says "note:", "remember this", "save snippet", "quick note", or wants to save/read short text snippets.

This skill appears to be a simple local notes utility and is internally coherent. Before installing: (1) be aware notes are stored in workspace_root/notes/quick-notes.md — don’t put secrets there if you need them protected; (2) the SKILL.md references a PowerShell script (note.ps1) that is not included — Windows support may be incomplete; (3) the script creates a backup file (quick-notes.md.bak) when deleting notes — check and clean backups if needed; (4) review the script yourself if you have strict security requirements (it uses grep, sed, cp and modifies files in the workspace but makes no network calls). If you plan to store sensitive data, prefer an encrypted storage solution instead of plaintext notes.

Type: OpenClaw Skill Name: quick-note-tool Version: 1.0.0 The skill provides note-taking functionality but contains shell injection vulnerabilities in `scripts/note.sh` due to a lack of input sanitization. Specifically, the `search` and `tag` commands are vulnerable to grep argument injection (e.g., passing flags like '-f' to read other files), and the `delete` command uses unvalidated input in a `sed` range-delete operation, which could be manipulated to delete unintended data. While these appear to be unintentional programming flaws rather than malicious intent, they represent a vulnerability that could be exploited via prompt injection against the AI agent.