evernote-core-workflow-b

Pass

Audited by Gen Agent Trust Hub on Mar 13, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: No security issues detected. The skill performs expected search and retrieval operations for Evernote.\n- [EXTERNAL_DOWNLOADS]: The skill utilizes the evernote package, which is a standard library from the npm registry and is considered a well-known service.\n- [DATA_EXFILTRATION]: No unauthorized data transfer or sensitive file access was found. Communication is restricted to the Evernote API via the official SDK using a provided access token.\n- [PROMPT_INJECTION]: The skill processes user search terms through a QueryBuilder that formats them for the Evernote API. This structure prevents direct instruction injection into the agent's logic.\n
  • Ingestion points: query parameters in SearchService.search and various QueryBuilder methods (SKILL.md).\n
  • Boundary markers: QueryBuilder uses double-quotes for query parameters (e.g., tag:\"${name}\").\n
  • Capability inventory: No dangerous system-level capabilities detected beyond Evernote API interaction.\n
  • Sanitization: Inputs are strictly encapsulated within search grammar operators.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 13, 2026, 12:15 PM