Algernon Debate

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:28 AM UTC
• Version: 1.0.0

Overview

This debate skill is coherent in its learning purpose, but it should be reviewed because it can read a local database, send debate content to Notion, and persist session notes without clear user consent or safe scoping.

Install only if you expect this skill to use that specific local study database and you are comfortable with debate summaries and critique being sent to the configured Notion page and saved locally. Before use, require explicit confirmation for export and logging, validate slugs, use read-only database access, and avoid passing user-derived Markdown through a shell command string.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:31
• Finding: User-Controlled Slug Embedded Directly in an SQLite Query## Vulnerability Details **File Location**: `SKILL.md`, lines 31-38 **Vulnerability Type**: SQL injection through unvalidated query construction **Risk Level**: High ### Vulnerable Code ```bash sqlite3 $DB \ "SELECT c.id, c.front, c.back FROM cards c JOIN decks d ON d.id = c.deck_id JOIN materials m ON m.id = d.material_id WHERE m.slug = 'SLUG' AND c.type = 'argumentative' ORDER BY RANDOM() LIMIT 5;" ``` ### Technical Analysis The skill accepts a slug through the `/algernon debate [SLUG]` command and instructs the agent to substitute it into a quoted SQL statement. No validation, escaping, or parameter binding is required before the value is incorporated into the query. A slug containing a single quote and additional SQL syntax could terminate the intended string literal and change the query semantics. Depending on how the instruction is implemented and which statements the installed `sqlite3` client accepts, this could permit access to unrelated tables or modification of the database. The database is also not explicitly opened in read-only mode, increasing the possible integrity impact. ### Attack Path 1. An attacker supplies a specially crafted value as the debate slug. 2. The agent substitutes that value for `SLUG` in the SQL command. 3. The substituted value terminates the `m.slug` string literal and introduces additional SQL syntax. 4. The local `sqlite3` process executes the altered query under the agent user's database permissions. 5. The attacker may cause unrelated records to be returned or, where stacked statements are accepted, attempt to modify accessible database content. ### Impact Assessment Successful exploitation could disclose information from other tables in `vestibular.db`, bypass the intended material filter, or damage database integrity. Access is limited to the SQLite database and filesystem permissions of the user running the agent; this finding does not establish privil ...[truncated 35 chars]
• Remediation: ## Remediation Suggestions - Validate the slug before use with a strict allowlist appropriate to material identifiers, such as `^[A-Za-z0-9_-]+$`. - Reject empty, malformed, or unexpectedly long values. - Replace shell-based SQL interpolation with a database API that supports bound parameters. - Open the database in read-only mode for this operation. - Run the query using an account with access only to the required database. - If the `sqlite3` CLI must be retained, resolve the slug against a trusted list rather than inserting raw user input into SQL.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:96
• Finding: Potential Shell Command Injection Through Interpolated Notion Content## Vulnerability Details **File Location**: `SKILL.md`, lines 96-101 **Vulnerability Type**: Shell command injection through user-derived Markdown **Risk Level**: High ### Vulnerable Code ```markdown ### Send to Notion ```bash ~/go/bin/notion-cli append --page-id PHASE_PAGE_ID --content "MARKDOWN" ``` Include the topic, the synthesis, and any gaps in the user's arguments. ``` ### Technical Analysis The `MARKDOWN` value is expected to contain the debate topic, synthesis, and observations derived from the user's arguments. The documented invocation places this content inside a shell command without specifying a safe argument-passing mechanism. If an implementation performs textual replacement of `MARKDOWN` before passing the resulting string to a shell, user-controlled quotation marks, command substitutions, or shell metacharacters can break out of the intended `--content` argument. Quoting the placeholder with double quotes is insufficient because shell command substitution remains active within double-quoted strings, and embedded quotation marks may alter parsing. Exploitability depends on the agent implementing the documented template through shell-string interpolation. Direct process invocation with a separate argument array would avoid this vulnerability. ### Attack Path 1. An attacker includes shell syntax in the debate topic or an argument. 2. The skill incorporates that text into the generated synthesis or description of argument gaps. 3. The generated Markdown is substituted textually for `MARKDOWN`. 4. The resulting command is executed through a shell. 5. The shell interprets the injected syntax and runs attacker-selected commands with the agent user's privileges. ### Impact Assessment Successful exploitation could execute arbitrary commands with the permissions of the local agent account. This may expose or alter files accessible to that account, modify the study database, access locally availabl ...[truncated 140 chars]
• Remediation: ## Remediation Suggestions - Never create the command by substituting content into a shell command string. - Invoke `notion-cli` through a process API using a fixed executable and separate argument array. - Prefer passing Markdown through standard input or a securely created file rather than a command-line argument. - Validate `PHASE_PAGE_ID` against the exact expected identifier format. - Treat the topic, user arguments, synthesis, and generated observations as untrusted data. - If shell execution is unavoidable, use robust shell-safe argument handling rather than manual escaping. - Add adversarial tests containing quotes, command substitutions, newlines, and shell metacharacters.

other

Warning

• Location: SKILL.md:96
• Finding: Undisclosed Export of Debate Content and Persistent Memory Write## Vulnerability Details **File Location**: `SKILL.md`, lines 96-109 **Vulnerability Type**: External data transmission and persistent storage of user-derived content **Risk Level**: Medium ### Vulnerable Code ```markdown ### Send to Notion ```bash ~/go/bin/notion-cli append --page-id PHASE_PAGE_ID --content "MARKDOWN" ``` Include the topic, the synthesis, and any gaps in the user's arguments. ### Save Memory Append to today's conversation log: ``` [HH:MM] debate session — MATERIAL_NAME Topic: [topic] | Key insight: [one sentence from synthesis] ``` ``` ### Technical Analysis The skill instructs the agent to send the debate topic, synthesis, and identified gaps in the user's arguments to Notion. It separately instructs the agent to append user-derived information to a persistent conversation log. Neither operation includes a consent prompt, destination preview, redaction requirement, retention policy, or opt-out mechanism. These side effects are not disclosed in the skill's frontmatter description, which describes a structured technical debate rather than external export and persistent retention. Consequently, a user may provide information under the assumption that it remains within the current exchange. The memory entry is partly derived from untrusted conversation content. If later sessions consume conversation logs as trusted instructions rather than inert data, crafted content may contaminate future context. The fixed log template limits the demonstrated poisoning capability, so persistent instruction execution is not established solely by the audited text. ### Attack Path 1. A user supplies a debate topic and arguments, potentially including private or attacker-crafted content. 2. The skill incorporates that content into its synthesis and assessment of argument gaps. 3. The skill transmits the resulting material to a configured Notion page without an explicit per-operation consent step. 4. The ...[truncated 703 chars]
• Remediation: ## Remediation Suggestions - Make Notion export and persistent logging disabled by default. - Obtain explicit user consent separately for external transmission and local retention. - Display the exact content, destination page, and storage location before writing. - Allow users to redact fields, skip export, skip memory storage, or delete previously stored entries. - Minimize exported data and avoid recording subjective assessments of user weaknesses unless specifically requested. - Document the external destination, retention period, access controls, and deletion procedure in the skill description. - Encode stored conversation values as inert data and never interpret them as instructions in later sessions. - Apply length limits and structural validation to persistent log fields. - Protect the Notion destination and local log with least-privilege access controls.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The broad natural-language triggers make it easier for the skill to activate unintentionally during ordinary conversation. That becomes more dangerous here because invocation may lead to local database reads, external publication, and session logging, so accidental activation can cascade into unintended data handling.

Context-Inappropriate Capability

Medium

• Confidence: 81% confidence
• Finding: The skill accesses a local SQLite study database to source topics, which exceeds a pure conversational role and touches local data stores. In context this appears functionally related, but it is still a security concern because broad file/database access can expose unrelated local content if the DB contains more than the expected argumentative cards or if slug selection is not tightly controlled.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The skill is presented as a debate/learning interaction, but it also instructs the agent to publish results to Notion and append session details to a conversation log. That creates hidden data persistence and external sharing beyond the user’s apparent request, which is dangerous because user-provided content and inferred weaknesses could be stored or disclosed without clear consent.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The Notion append command gives the skill external publication capability without showing a clear justification, authorization check, or consent step. This is risky because the synthesis and argument gaps may contain sensitive user content or performance assessments that get exfiltrated to a third-party service.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill exports content to Notion without any user-facing warning or disclosure. This is dangerous because users may reasonably believe they are participating in a local debate interaction, while their responses and the model’s evaluation of their gaps are actually being sent to an external platform.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The skill states that the debate session will be appended to a conversation log, but provides no notice or consent mechanism. Silent retention of topic choices and summarized insights can create privacy issues, especially if users do not expect their interactions to be stored for future reference.

Static analysis

No suspicious patterns detected.