UpNote

Manage UpNote notes and notebooks via x-callback-url automation. Use when a user asks to create notes, open notes, create notebooks, view tags, or manage content in UpNote.

This skill is a thin macOS helper that constructs upnote:// x-callback URLs and opens the UpNote app. It does not ask for credentials or send data over the network. Consider these points before installing: (1) It appears macOS-specific ('open' is used) even though the skill metadata has no OS restriction. (2) Some parameters (noteId, notebookId, view mode) are not consistently URL-encoded in the script — this is likely a bug that can cause malformed URLs but is not an exfiltration risk. (3) Because the skill can be invoked autonomously by the agent (platform default), ensure you trust agents that might call it to avoid unwanted note creation/opens. If you need cross-platform behavior or stricter input handling, request updates from the author to URL-encode all user-supplied values and declare OS compatibility.

Type: OpenClaw Skill Name: upnote Version: 1.0.1 The skill bundle is benign. The `SKILL.md` provides clear, non-malicious instructions for the AI agent to manage UpNote notes and notebooks. The `scripts/upnote.sh` script correctly uses `urlencode` for all user-controlled string inputs (like titles, text, notebook names, tags, and search queries) before constructing `upnote://x-callback-url` commands. This prevents shell injection vulnerabilities. The script's functionality is limited to interacting with the UpNote application via its documented x-callback-url scheme, with no evidence of data exfiltration, malicious execution, persistence mechanisms, or prompt injection attempts to subvert the agent's intended purpose.