Algernon Synthesis

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:28 AM UTC
• Version: 1.0.0

Overview

This study skill is mostly coherent, but it can send user answers and inferred learning gaps to Notion and local logs without a clear confirmation step.

Review before installing. Only use this skill if you are comfortable with synthesis-session content being written to your configured Notion workspace and a local conversation log. Avoid entering sensitive scenarios unless the skill is changed to require confirmation, show the exact content and destination, and pass Notion content without shell interpolation.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

other

Warning

• Location: SKILL.md:92
• Finding: Undisclosed Transfer of User Content and Learning Assessments to Notion<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 92-103 **Vulnerability Type**: Undisclosed External Data Transfer **Risk Level**: Medium ### Vulnerable Code ```markdown ### Send to Notion Send to the Notion page of the most recent phase studied: ```bash ~/go/bin/notion-cli append --page-id PHASE_PAGE_ID --content "MARKDOWN" ``` Include: - Cross-material concepts explored - Gaps identified (bridges that need reinforcement) - The production scenario the user described ``` ### Technical Analysis The skill directs the agent to upload session information to a Notion page. The transmitted data includes user-generated production scenarios and inferred learning gaps, which may constitute private educational-profile information. The skill's declared description only presents it as a cross-material synthesis session. It does not disclose that responses and assessments will be sent to an external Notion workspace. The workflow also lacks an explicit consent prompt, content preview, destination confirmation, or local-only option before transmission. Although the command uses a locally installed Notion CLI, that tool communicates with an external service. Consequently, the fact that the executable is local does not make the resulting data processing local. ### Attack Path 1. A user invokes the synthesis skill and answers its questions. 2. The agent derives conceptual strengths and learning gaps from those answers. 3. The agent incorporates the user's production scenario and inferred gaps into `MARKDOWN`. 4. The agent executes `notion-cli append` using the selected phase page. 5. The information is transferred to and retained in the configured Notion workspace without a dedicated approval step. ### Impact Assessment The affected information can include the user's technical ideas, study history, educational weaknesses, and other content included in free-text answers. Anyone with access to the destination Notion workspace may be able to vi ...[truncated 330 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Disclose in the skill description that session content may be transferred to Notion. 2. Before invoking the Notion CLI, display: - The exact destination workspace or page identifier. - The complete content proposed for upload. - The categories of personal or inferred information included. 3. Require explicit, informed user confirmation immediately before transmission. 4. Provide a local-only mode and make external synchronization opt-in. 5. Allow users to redact or exclude their scenario, inferred weaknesses, and other sensitive fields. 6. Minimize uploaded data and define an appropriate retention policy. 7. Verify that the destination page has least-privilege access controls and is not publicly shared. 8. Record whether consent was granted without storing additional sensitive response content. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:94
• Finding: Potential Shell Command Injection Through Unescaped Markdown Content<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 94-103 **Vulnerability Type**: Shell Command Injection **Risk Level**: Medium ### Vulnerable Code ```markdown Send to the Notion page of the most recent phase studied: ```bash ~/go/bin/notion-cli append --page-id PHASE_PAGE_ID --content "MARKDOWN" ``` Include: - Cross-material concepts explored - Gaps identified (bridges that need reinforcement) - The production scenario the user described ``` ### Technical Analysis The `MARKDOWN` value is intended to contain user-controlled text, including the production scenario supplied through a free-text question. The skill presents this dynamic value inside a shell command but does not require safe argument-array execution, shell escaping, or file-based input. If an implementing agent replaces the `MARKDOWN` placeholder by constructing a shell command string, double quotes alone are insufficient protection. Shell constructs such as command substitution remain active inside double-quoted strings. For example, content containing `$(command)` or a backtick command substitution could be evaluated by the shell before `notion-cli` receives the argument. An embedded double quote could also terminate the argument and introduce shell operators. The vulnerability is conditional on the agent performing textual interpolation and executing the result through a shell. The instructions nevertheless establish an unsafe execution pattern and provide no requirement that would prevent this implementation. ### Attack Path 1. The attacker supplies a production-scenario answer containing shell syntax, such as a command substitution or a quote followed by a shell operator. 2. The agent includes the answer in the Markdown destined for Notion. 3. The agent substitutes that Markdown directly into the documented command template. 4. The constructed command is passed to a shell. 5. The shell interprets the injected syntax before launching or while processing the `noti ...[truncated 829 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not construct a shell command by substituting user-controlled content into a command string. 2. Invoke `notion-cli` through a process API that accepts an argument array, for example: - Executable: `/home/antonio/go/bin/notion-cli` - Arguments: `["append", "--page-id", validatedPageId, "--content", markdown]` 3. Ensure the process API does not invoke a shell. 4. If supported by the CLI, write the Markdown to a securely created temporary file and pass it through a dedicated file-input argument. 5. Create temporary files with restrictive permissions, unpredictable names, and guaranteed cleanup. 6. Validate `PHASE_PAGE_ID` against the exact identifier syntax accepted by Notion; do not interpolate it into a shell command. 7. Treat all free-text answers, generated summaries, material names, and database-derived fields as untrusted data. 8. If shell execution is unavoidable, apply robust platform-specific quoting to every dynamic value. This is less reliable than avoiding the shell and should only be a fallback. 9. Add tests containing double quotes, semicolons, newlines, backticks, and `$(...)` to verify that they are passed as literal content and never executed. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill’s stated purpose is an interactive synthesis session, but it also persists user-derived session content to Notion and local logs. That creates a data-flow expansion beyond what a user would reasonably expect from a study interaction, increasing privacy and confidentiality risk if answers contain sensitive notes, project details, or personal data.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The Notion append action grants write capability to an external system even though the core skill goal is concept synthesis, not data publication. Without a clear necessity check and user approval, the skill can exfiltrate user-provided learning content or operational details to a third-party destination.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill sends session-derived content to Notion but provides no user-facing warning that data will leave the immediate interaction and be stored in an external system. This undermines informed consent and can lead to unintended disclosure of sensitive educational, technical, or personal information.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill persistently stores conversation details in a local log without warning the user, which is a transparency and privacy issue. Users may provide candid answers assuming ephemerality, while the skill silently creates a durable record that could later be accessed, indexed, or repurposed.

Context-Inappropriate Capability

Low

• Confidence: 88% confidence
• Finding: Appending synthesis-session details to a conversation log introduces persistent local storage that is not essential to answering the user’s immediate request. Even local-only retention can expose study history, inferred weaknesses, and possibly sensitive free-text responses to other local users, backups, or later unintended reuse.

Static analysis

No suspicious patterns detected.