other
Warning
- Location
SKILL.md:92- Finding
Undisclosed Transfer of User Content and Learning Assessments to Notion
- Content
View full analysis
- Remediation
View remediation
Security audit
Algernon Synthesis
Security checks for vulnerabilities and agentic risk
Overview
This study skill is mostly coherent, but it can send user answers and inferred learning gaps to Notion and local logs without a clear confirmation step.
Review before installing. Only use this skill if you are comfortable with synthesis-session content being written to your configured Notion workspace and a local conversation log. Avoid entering sensitive scenarios unless the skill is changed to require confirmation, show the exact content and destination, and pass Notion content without shell interpolation.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:94- Finding
Potential Shell Command Injection Through Unescaped Markdown Content
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill’s stated purpose is an interactive synthesis session, but it also persists user-derived session content to Notion and local logs. That creates a data-flow expansion beyond what a user would reasonably expect from a study interaction, increasing privacy and confidentiality risk if answers contain sensitive notes, project details, or personal data.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The Notion append action grants write capability to an external system even though the core skill goal is concept synthesis, not data publication. Without a clear necessity check and user approval, the skill can exfiltrate user-provided learning content or operational details to a third-party destination.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill sends session-derived content to Notion but provides no user-facing warning that data will leave the immediate interaction and be stored in an external system. This undermines informed consent and can lead to unintended disclosure of sensitive educational, technical, or personal information.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill persistently stores conversation details in a local log without warning the user, which is a transparency and privacy issue. Users may provide candid answers assuming ephemerality, while the skill silently creates a durable record that could later be accessed, indexed, or repurposed.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
Appending synthesis-session details to a conversation log introduces persistent local storage that is not essential to answering the user’s immediate request. Even local-only retention can expose study history, inferred weaknesses, and possibly sensitive free-text responses to other local users, backups, or later unintended reuse.
- Content