T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:28- Finding
Unvalidated Slug Enables SQL Injection and Potential Shell Command Injection
- Content
View full analysis
- Remediation
View remediation
Security audit
Algernon Texto
Security checks for vulnerabilities and agentic risk
Overview
This skill is a coherent guided-reading helper, but it can read broad local material paths and silently write session-derived content locally or to Notion without clear user confirmation.
Review this skill before installing. It fits an OpenAlgernon study workflow, but only use it with trusted material databases and manifests, and be aware that configured Notion credentials may cause generated concepts and flashcards to be uploaded. Prefer a version that validates slugs and material paths, previews external exports, and asks before saving local memory.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:34- Finding
Unrestricted Material Paths Permit Arbitrary Local File Read
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The trigger phrases include broad natural-language expressions like 'quero ler [material]' and 'modo texto', which can overlap with ordinary conversation and cause unintended skill activation. In context, accidental activation matters because this skill can read local materials, generate derivative content, and potentially write data externally or to local logs.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill advertises a guided reading mode, but it also performs additional actions unrelated to simply presenting content: generating study cards, exporting material-derived content to Notion, and persisting session metadata locally. This violates least surprise and expands the data-handling surface, creating privacy and scope-creep risk if users invoke the skill expecting only transient reading assistance.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
Automatic card generation is outside the narrow scope of a block-by-block reading skill and introduces additional processing of user interaction history, especially the tracked
/explainand/deep-diveterms. While less severe than external export, it still broadens the skill's function beyond what a user may reasonably expect from 'texto' mode.- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
Uploading session-derived content to Notion is a separate exfiltration pathway from the local reading workflow. Even though it is conditioned on environment variables, the skill provides no explicit runtime user confirmation before transmitting generated summaries and concepts to a third-party service, which can expose sensitive reading activity or derived notes.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill description does not warn users that session-derived content may be uploaded to Notion, reducing transparency about external data sharing. Lack of notice undermines informed consent and can lead to unintended disclosure of reading topics, summaries, and generated study artifacts.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill silently appends session metadata to a local conversation log without telling the user, which creates an undisclosed persistence mechanism. Although the stored data appears limited to material name and counts, it still records reading activity and could be sensitive in some environments.
- Content
Static analysis
No suspicious patterns detected.