Algernon Feynman

Security checks across malware telemetry and agentic risk

Overview

This is a coherent study-session skill that reads OpenAlgernon study cards and may save a short progress summary locally or to Notion, with no evidence of malicious behavior.

Before installing, confirm you are comfortable with the skill reading your OpenAlgernon study database and saving session summaries locally. Only enable the Notion save if the configured Notion CLI and page are trusted and appropriate for this study data.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Risk analysis

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

#
ASI04: Agentic Supply Chain Vulnerabilities
Info
What this means

The skill may not work unless the expected local tools are available, and an unexpected binary with the same name on PATH could be invoked.

Why it was flagged

The skill relies on local command-line tools, while the provided requirements declare no required binaries or environment variables. Users should ensure the sqlite3 and notion-cli binaries on PATH are the trusted ones.

Skill content
sqlite3 "$DB" ... "$NOTION_CLI" append --page-id "$NOTION_PAGE_ID" --content "MARKDOWN"
Recommendation

Use trusted installations of sqlite3 and notion-cli, and confirm PATH and environment variables before enabling the optional Notion save.

#
ASI03: Identity and Privilege Abuse
Low
What this means

If enabled, study-session details and weak points could be appended to a Notion page.

Why it was flagged

The optional Notion save can write the session summary to a Notion page using whatever account and permissions the local Notion CLI is configured with.

Skill content
If `$NOTION_CLI` is available and `$NOTION_PAGE_ID` is set:

"$NOTION_CLI" append --page-id "$NOTION_PAGE_ID" --content "MARKDOWN"
Recommendation

Confirm the Notion page ID and the account used by notion-cli before saving session summaries externally.

#
ASI06: Memory and Context Poisoning
Low
What this means

Future sessions or tools that read this memory may see what topics the user struggled with.

Why it was flagged

The skill persists a summary of the user's study performance and weak areas into a local conversation memory file.

Skill content
echo "[HH:MM] feynman session -- MATERIAL_NAME | Concepts: N | Passed: X | Needs work: LIST" \
  >> "${ALGERNON_HOME}/memory/conversations/YYYY-MM-DD.md"
Recommendation

Use the memory feature only if persistent study tracking is desired, and periodically review or delete saved memory entries if they are sensitive.