bear-notes
Pass
Audited by Gen Agent Trust Hub on May 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs the grizzly utility from its source repository on GitHub (github.com/tylerwince/grizzly) using the Go command line tool.- [COMMAND_EXECUTION]: Provides functionality to create, read, and manage notes by executing the grizzly CLI with various arguments and flags.- [CREDENTIALS_UNSAFE]: References a Bear API token stored locally at ~/.config/grizzly/token. The instructions explain how a user can manually set up this token for authenticated operations.- [SAFE]: Reading external note content via grizzly commands introduces a surface for indirect prompt injection, which is a common characteristic of applications that process user-generated content and does not suggest malicious intent.
Audit Metadata