T09 · Insecure Skill Coding Practices
- Location
references/contract-comparison.md:102- Finding
Confidential Legal Documents May Be Published to Notion Without Per-Operation Consent
- Content
View full analysis
Vulnerability Details
File Location:
references/contract-comparison.md:102-103Additional Affected Locations:
references/contract-drafting.md:230-231references/contract-review.md:131-132references/contract-tracker.md:109-110- Related connector behavior is declared in
references/legal-lookup.md:9-15,references/nda-screening.md:9-15, andreferences/word-format-spec.md:124.
Vulnerability Type: Automatic publication of sensitive legal content through an active external connector
Risk Level: Medium
Complete Code Snippet:
markdown **如已连接 Notion：** - 将对比报告发布到 Notion，便于团队批注讨论Equivalent contract-drafting instruction:
markdown **如已连接 Notion：** - 将合同文档发布到 Notion，便于团队协作审阅Equivalent contract-review instruction:
markdown **如已连接 Notion：** - 将审查报告发布到 Notion，便于团队批注讨论Equivalent contract-tracker instruction:
markdown **如已连接 Notion：** 1. 将台账报告发布到 Notion，包含：合同名称、状态、到期日期、剩余天数、续约模式、负责人 2. 便于团队查阅和持续更新Technical Analysis
The affected workflows direct the agent to publish generated material whenever a Notion connector is connected. They do not require explicit authorization for each publication, display or validate the destination workspace and page, restrict sharing permissions, or perform data minimization and redaction.
Contract documents and derived reports can contain party identities, personal contact details, commercial terms, pricing, intellectual property provisions, legal strategy, dispute information, and responsible-person data. Treating connector availability as sufficient authorization creates an unsafe disclosure path. The connector is openly documented, so the behavior is not covert exfiltration, but it lacks controls appropriate for confidential legal information.
Exploitation depends on an active Notion connector with write access. No operating-system privilege escalation or arbitrary code execution is involved.
...[truncated 1243 chars]
- Remediation
View remediation
Remediation Suggestions
- Default to local file generation or in-conversation output, even when a connector is active.
- Before every external publication, request explicit user confirmation and display:
- The destination workspace and page.
- The data categories that will be transferred.
- The intended audience and current sharing permissions.
- Require the user to select or approve the destination rather than relying on a previously configured default.
- Minimize data before transfer. Redact personal identifiers, signatures, contact details, bank details, pricing, and unnecessary contract text.
- Create private pages by default and apply least-privilege access controls.
- Provide a preview of the exact content to be published.
- Record an audit event containing user approval, destination, timestamp, and publication result.
- Return the resulting page URL and effective access scope so the user can verify and revoke access.
- Apply the same confirmation and redaction controls consistently across all affected workflows.