Security audit

Convert Notion HTML exports to interactive mind maps

Security checks for vulnerabilities and agentic risk

Overview

The skill does convert Notion exports into a mind map, but crafted input can inject script into the generated HTML, so it needs review before installation.

Review before installing or use only with trusted Notion exports. A maliciously crafted export could make the generated mindmap.html run JavaScript when opened, so run it in a separate folder, avoid overwriting important files, use an isolated pinned Python environment, and validate any custom Notion base URL before generating links.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/generate_html.py:11
Finding: Stored Script Injection in Generated Mind Map HTML
Content: View full analysis
\n' '\n' '\n' '\n' '\n' '' + workspace_title + ' - 思维导图\n' # ... '` sequence terminates the script element even when that sequence occurs inside a JavaScript string. Consequently, a malicious title containing a sequence such as `` can escape the data block and introduce executable JavaScript. The separate insertion into `` is also unsafe. A value containing ` ...[truncated 1412 chars]
Remediation: View remediation
` element: ```python import html safe_workspace_title = html.escape(workspace_title, quote=True) ``` 2. Do not concatenate ordinary JSON directly into an executable script element. Store it in a non-executable JSON element and escape characters significant to HTML parsing: ```python json_str = json.dumps(data, ensure_ascii=False, separators=(',', ':')) json_str = ( json_str .replace('&', '\\u0026') .replace('<', '\\u003c') .replace('>', '\\u003e') .replace('\u2028', '\\u2028') .replace('\u2029', '\\u2029') ) ``` Then embed and parse it as data: ```html ``` 3. Prefer DOM APIs such as `textContent` whenever untrusted values are rendered into HTML. 4. Add a restrictive Content Security Policy to limit the impact of any remaining injection issue. Moving JavaScript to a separate local file would allow inline scripts to be disabled. 5. Add regression tests containing values such as: ```text <>&"' and Unicode line separators ``` The tests should verify that these strings remain inert text in the generated document. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/build_mindmap.py:80
Finding: Unvalidated Base URL Allows Dangerous Node Link Schemes
Content: View full analysis
2 else None ``` It is concatenated directly with a page identifier: ```python page_id = extract_id_from_ul(ul_elem) link = notion_base + page_id if (notion_base and page_id) else None ``` The resulting value is subsequently opened by the generated page: ```javascript if (e.ctrlKey || e.metaKey) { if (n.link) window.open(n.link, "_blank"); } ``` ### Technical Analysis The documented purpose of `notion_base` is to specify a Notion HTTPS workspace URL, but the code accepts any string. It does not parse the URL, enforce HTTPS, verify the hostname, or reject active and unexpected schemes. An attacker-controlled value can therefore produce links using schemes such as `javascript:`, `data:`, or other protocol handlers. The behavior of active schemes passed to `window.open()` varies by browser and security context, but relying on browser-specific blocking is unsafe. At minimum, arbitrary external links can be generated, allowing trusted-looking mind-map nodes to redirect users to attacker-controlled locations. The URL is also opened with `_blank` without explicitly requesting `noopener` and `noreferrer`, which can increase opener-related risks in environments that do not automatically isolate new tabs. ### Attack Path 1. An attacker supplies a malicious base URL or persuades the operator to invoke the parser with one: ```bash python build_mindmap.py index.html '' ``` 2. `build_mindmap.py` concatenates the unvalidated base value with every extracted page ID. 3. `generate_html.py` embeds the resulting links in `mindmap.html`. 4. The victim ...[truncated 866 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: SKILL.md:39
Finding: Unpinned Third-Party Dependency Installation
Content: View full analysis
Remediation: View remediation
``` 2. Generate and verify cryptographic hashes, for example through a hash-locked requirements file used with: ```bash python -m pip install --require-hashes -r requirements.txt ``` 3. Record and lock relevant transitive dependencies. 4. Use a dedicated virtual environment instead of installing into a shared or privileged Python environment. 5. Document the expected package index explicitly and avoid untrusted mirrors: ```bash python -m pip install --index-url https://pypi.org/simple --require-hashes -r requirements.txt ``` 6. Periodically review and update pinned versions to incorporate security patches rather than leaving the version unconstrained. ]]>

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill explicitly describes reading a user-provided HTML file and generating output files, but it does not declare any tool scope or permission boundaries. That creates an authorization gap: the agent may use file read/write capabilities without an explicit least-privilege contract, making unintended file access or overwrite more likely if the skill is triggered in the wrong context.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger condition is overly broad because it activates on generic mentions of '思维导图' or 'mindmap', even when the user may not be asking to process a Notion export. Overbroad activation can cause the agent to invoke file-processing behavior in irrelevant contexts, increasing the chance of unnecessary file access, unintended outputs, or misuse of the skill on unsuitable inputs.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The generated document sets lang="zh-CN" and the embedded UI strings throughout the HTML are in Chinese, which imposes a specific language/locale on all users. The file does not provide any opt-in, configuration, or documented justification for restricting output to this locale.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill is described as converting exported Notion HTML into an interactive mindmap, but the generated output also provides capabilities to open embedded links in new tabs and copy them to the clipboard. While links are mentioned in the manifest, this code will act on whatever URL is present in the input data, effectively enabling arbitrary external navigation from the generated artifact rather than just visualization.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The natural-language content from L03 onward is predominantly Chinese, which effectively forces a specific language for users reading the skill documentation. The file does not offer an alternative language, opt-in, or explanation that this skill is intentionally region- or locale-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The natural-language instructions and usage description are presented in Chinese, which may implicitly force a specific language experience without user opt-in. The file does not state that the skill is intended only for Chinese-speaking users or offer alternate language behavior.
Content: No source excerpt is available for this finding.