ClawHub
Back to skill

Security audit

Algernon Debate

Security checks for vulnerabilities and agentic risk

Overview

This debate skill is coherent in its learning purpose, but it should be reviewed because it can read a local database, send debate content to Notion, and persist session notes without clear user consent or safe scoping.

Install only if you expect this skill to use that specific local study database and you are comfortable with debate summaries and critique being sent to the configured Notion page and saved locally. Before use, require explicit confirmation for export and logging, validate slugs, use read-only database access, and avoid passing user-derived Markdown through a shell command string.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:31
Finding

User-Controlled Slug Embedded Directly in an SQLite Query

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 31-38
Vulnerability Type: SQL injection through unvalidated query construction
Risk Level: High

Vulnerable Code

bash
sqlite3 $DB \
  "SELECT c.id, c.front, c.back FROM cards c
   JOIN decks d ON d.id = c.deck_id
   JOIN materials m ON m.id = d.material_id
   WHERE m.slug = 'SLUG' AND c.type = 'argumentative'
   ORDER BY RANDOM() LIMIT 5;"

Technical Analysis

The skill accepts a slug through the /algernon debate [SLUG] command and instructs the agent to substitute it into a quoted SQL statement. No validation, escaping, or parameter binding is required before the value is incorporated into the query.

A slug containing a single quote and additional SQL syntax could terminate the intended string literal and change the query semantics. Depending on how the instruction is implemented and which statements the installed sqlite3 client accepts, this could permit access to unrelated tables or modification of the database. The database is also not explicitly opened in read-only mode, increasing the possible integrity impact.

Attack Path

  1. An attacker supplies a specially crafted value as the debate slug.
  2. The agent substitutes that value for SLUG in the SQL command.
  3. The substituted value terminates the m.slug string literal and introduces additional SQL syntax.
  4. The local sqlite3 process executes the altered query under the agent user's database permissions.
  5. The attacker may cause unrelated records to be returned or, where stacked statements are accepted, attempt to modify accessible database content.

Impact Assessment

Successful exploitation could disclose information from other tables in vestibular.db, bypass the intended material filter, or damage database integrity. Access is limited to the SQLite database and filesystem permissions of the user running the agent; this finding does not establish privil ...[truncated 35 chars]

Remediation
View remediation

Remediation Suggestions

  • Validate the slug before use with a strict allowlist appropriate to material identifiers, such as ^[A-Za-z0-9_-]+$.
  • Reject empty, malformed, or unexpectedly long values.
  • Replace shell-based SQL interpolation with a database API that supports bound parameters.
  • Open the database in read-only mode for this operation.
  • Run the query using an account with access only to the required database.
  • If the sqlite3 CLI must be retained, resolve the slug against a trusted list rather than inserting raw user input into SQL.

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:96
Finding

Potential Shell Command Injection Through Interpolated Notion Content

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 96-101
Vulnerability Type: Shell command injection through user-derived Markdown
Risk Level: High

Vulnerable Code

markdown
### Send to Notion

```bash
~/go/bin/notion-cli append --page-id PHASE_PAGE_ID --content "MARKDOWN"

Include the topic, the synthesis, and any gaps in the user's arguments.

text

### Technical Analysis

The `MARKDOWN` value is expected to contain the debate topic, synthesis, and observations derived from the user's arguments. The documented invocation places this content inside a shell command without specifying a safe argument-passing mechanism.

If an implementation performs textual replacement of `MARKDOWN` before passing the resulting string to a shell, user-controlled quotation marks, command substitutions, or shell metacharacters can break out of the intended `--content` argument. Quoting the placeholder with double quotes is insufficient because shell command substitution remains active within double-quoted strings, and embedded quotation marks may alter parsing.

Exploitability depends on the agent implementing the documented template through shell-string interpolation. Direct process invocation with a separate argument array would avoid this vulnerability.

### Attack Path

1. An attacker includes shell syntax in the debate topic or an argument.
2. The skill incorporates that text into the generated synthesis or description of argument gaps.
3. The generated Markdown is substituted textually for `MARKDOWN`.
4. The resulting command is executed through a shell.
5. The shell interprets the injected syntax and runs attacker-selected commands with the agent user's privileges.

### Impact Assessment

Successful exploitation could execute arbitrary commands with the permissions of the local agent account. This may expose or alter files accessible to that account, modify the study database, access locally availabl
...[truncated 140 chars]
Remediation
View remediation

Remediation Suggestions

  • Never create the command by substituting content into a shell command string.
  • Invoke notion-cli through a process API using a fixed executable and separate argument array.
  • Prefer passing Markdown through standard input or a securely created file rather than a command-line argument.
  • Validate PHASE_PAGE_ID against the exact expected identifier format.
  • Treat the topic, user arguments, synthesis, and generated observations as untrusted data.
  • If shell execution is unavoidable, use robust shell-safe argument handling rather than manual escaping.
  • Add adversarial tests containing quotes, command substitutions, newlines, and shell metacharacters.

other

Warning
Location
SKILL.md:96
Finding

Undisclosed Export of Debate Content and Persistent Memory Write

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 96-109
Vulnerability Type: External data transmission and persistent storage of user-derived content
Risk Level: Medium

Vulnerable Code

markdown
### Send to Notion

```bash
~/go/bin/notion-cli append --page-id PHASE_PAGE_ID --content "MARKDOWN"

Include the topic, the synthesis, and any gaps in the user's arguments.

Save Memory

Append to today's conversation log:

text
[HH:MM] debate session — MATERIAL_NAME
Topic: [topic] | Key insight: [one sentence from synthesis]
text

### Technical Analysis

The skill instructs the agent to send the debate topic, synthesis, and identified gaps in the user's arguments to Notion. It separately instructs the agent to append user-derived information to a persistent conversation log. Neither operation includes a consent prompt, destination preview, redaction requirement, retention policy, or opt-out mechanism.

These side effects are not disclosed in the skill's frontmatter description, which describes a structured technical debate rather than external export and persistent retention. Consequently, a user may provide information under the assumption that it remains within the current exchange.

The memory entry is partly derived from untrusted conversation content. If later sessions consume conversation logs as trusted instructions rather than inert data, crafted content may contaminate future context. The fixed log template limits the demonstrated poisoning capability, so persistent instruction execution is not established solely by the audited text.

### Attack Path

1. A user supplies a debate topic and arguments, potentially including private or attacker-crafted content.
2. The skill incorporates that content into its synthesis and assessment of argument gaps.
3. The skill transmits the resulting material to a configured Notion page without an explicit per-operation consent step.
4. The
...[truncated 703 chars]
Remediation
View remediation

Remediation Suggestions

  • Make Notion export and persistent logging disabled by default.
  • Obtain explicit user consent separately for external transmission and local retention.
  • Display the exact content, destination page, and storage location before writing.
  • Allow users to redact fields, skip export, skip memory storage, or delete previously stored entries.
  • Minimize exported data and avoid recording subjective assessments of user weaknesses unless specifically requested.
  • Document the external destination, retention period, access controls, and deletion procedure in the skill description.
  • Encode stored conversation values as inert data and never interpret them as instructions in later sessions.
  • Apply length limits and structural validation to persistent log fields.
  • Protect the Notion destination and local log with least-privilege access controls.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The broad natural-language triggers make it easier for the skill to activate unintentionally during ordinary conversation. That becomes more dangerous here because invocation may lead to local database reads, external publication, and session logging, so accidental activation can cascade into unintended data handling.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
81% confidence
Finding

The skill accesses a local SQLite study database to source topics, which exceeds a pure conversational role and touches local data stores. In context this appears functionally related, but it is still a security concern because broad file/database access can expose unrelated local content if the DB contains more than the expected argumentative cards or if slug selection is not tightly controlled.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill is presented as a debate/learning interaction, but it also instructs the agent to publish results to Notion and append session details to a conversation log. That creates hidden data persistence and external sharing beyond the user’s apparent request, which is dangerous because user-provided content and inferred weaknesses could be stored or disclosed without clear consent.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The Notion append command gives the skill external publication capability without showing a clear justification, authorization check, or consent step. This is risky because the synthesis and argument gaps may contain sensitive user content or performance assessments that get exfiltrated to a third-party service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill exports content to Notion without any user-facing warning or disclosure. This is dangerous because users may reasonably believe they are participating in a local debate interaction, while their responses and the model’s evaluation of their gaps are actually being sent to an external platform.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill states that the debate session will be appended to a conversation log, but provides no notice or consent mechanism. Silent retention of topic choices and summarized insights can create privacy issues, especially if users do not expect their interactions to be stored for future reference.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.