evernote-core-workflow-b
Pass
Audited by Gen Agent Trust Hub on Mar 13, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No security issues detected. The skill performs expected search and retrieval operations for Evernote.\n- [EXTERNAL_DOWNLOADS]: The skill utilizes the
evernotepackage, which is a standard library from the npm registry and is considered a well-known service.\n- [DATA_EXFILTRATION]: No unauthorized data transfer or sensitive file access was found. Communication is restricted to the Evernote API via the official SDK using a provided access token.\n- [PROMPT_INJECTION]: The skill processes user search terms through aQueryBuilderthat formats them for the Evernote API. This structure prevents direct instruction injection into the agent's logic.\n - Ingestion points:
queryparameters inSearchService.searchand variousQueryBuildermethods (SKILL.md).\n - Boundary markers:
QueryBuilderuses double-quotes for query parameters (e.g.,tag:\"${name}\").\n - Capability inventory: No dangerous system-level capabilities detected beyond Evernote API interaction.\n
- Sanitization: Inputs are strictly encapsulated within search grammar operators.
Audit Metadata