T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:60- Finding
Hard-Coded Notion Parent Page Can Redirect Research Reports to an Unintended Destination
- Content
View full analysis
- Remediation
View remediation
Security audit
Gemini Deep Research → Notion
Security checks for vulnerabilities and agentic risk
Overview
This skill does what it claims, but it uses your browser session and Notion token to export full reports to a hard-coded destination without enough confirmation or safeguards.
Install only if you are comfortable with the agent using your logged-in Gemini browser profile, reading your local Notion API key, saving full reports temporarily under /tmp, and exporting them to Notion. Before use, replace and verify the Notion parent page ID, restrict the Notion integration to the intended page, and avoid sensitive research topics unless you add an explicit review step before export.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (11)
Natural-Language Policy Violations
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Forcing every query to be prefixed with '请用中文回答。' overrides user intent and changes output language without consent. While not a classic data-security issue, it is a policy and integrity concern because it silently modifies user requests and can affect comprehension, review, and downstream handling of the exported content.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The workflow instructs the agent to read and reuse a locally stored API secret, which is a direct secret-handling anti-pattern. In context, that secret is then used to transmit report contents to Notion, so compromise or misuse could extend to unauthorized workspace writes and abuse of the user's integration privileges.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README advertises extracting a full research report and exporting it to Notion, an external third-party service, but does not clearly warn that gathered content will be transmitted outside the local environment. In a skill that automates browser research and handles potentially sensitive user-provided topics or report contents, this omission can lead to unintended data disclosure and poor consent practices.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The README states the skill 'runs as a subagent — non-blocking for main session' while the metadata explicitly says all steps must execute in the main session because the browser tool requires it. This contradiction can cause operators or downstream agents to invoke the skill in the wrong execution context, leading to unsafe assumptions about isolation, permissions, and where sensitive browser actions occur.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The trigger conditions are overly broad and ambiguous, such as activating when the user 'wants an in-depth research report.' This can cause the skill to run unexpectedly and perform browser automation, long waits, file writes, and third-party export without sufficiently specific invocation boundaries.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 84% confidence
- Finding
Writing the full research report to /tmp creates local session persistence of potentially sensitive data. Temporary directories may be accessible to other processes or persist longer than expected, increasing the chance of unintended disclosure or forensic recovery.
- Content
md 3. Get total length: `document.querySelectorAll('message-content')[2]?.innerText?.length` 4. Extract in 8000-char chunks using substring: `document.querySelectorAll('message-content')[N]?.innerText?.substring(START, END)` 5. Concatenate all chunks into the full report text 6. Save to a temp file: write full report to `/tmp/deep_research_<timestamp>.md` ### Phase 4: Export to Notion
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill writes the generated report to a local temp file and exports the content to Notion, but the user-facing description does not clearly warn about these persistence and exfiltration behaviors. Hidden storage and external transmission increase the risk of mishandling sensitive or proprietary user prompts and research outputs.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill explicitly reads a locally stored Notion API key from disk and reuses it for outbound API calls. Accessing a local secret is security-sensitive and exceeds what a browser-driven research skill should do unless the user has been clearly informed and consented, because it enables credential use and data export outside the browser context.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The instruction to read a Notion API key from ~/.config/notion/api_key accesses a sensitive local credential without any explicit warning or consent flow. This is dangerous because it normalizes secret harvesting behavior and allows the skill to authenticate outbound requests using local privileges the user may not expect it to consume.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 89% confidence
- Finding
The Notion API endpoint itself indicates third-party data transfer to an external service. In this skill's context that transfer is functional rather than inherently malicious, but it remains risky because the report contents and metadata may contain confidential information and are transmitted using a local credential the user may not realize is being used.
- Content
- Split rich_text at 2000 chars
- Create the page via Notion API:
bash curl -s -X POST "https://api.notion.com/v1/pages" \ -H "Authorization: Bearer $NOTION_KEY" \ -H "Notion-Version: 2025-09-03" \ -H "Content-Type: application/json" \
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 89% confidence
- Finding
The Notion API endpoint itself indicates third-party data transfer to an external service. In this skill's context that transfer is functional rather than inherently malicious, but it remains risky because the report contents and metadata may contain confidential information and are transmitted using a local credential the user may not realize is being used.
- Content
- Split rich_text at 2000 chars
- Create the page via Notion API:
bash curl -s -X POST "https://api.notion.com/v1/pages" \ -H "Authorization: Bearer $NOTION_KEY" \ -H "Notion-Version: 2025-09-03" \ -H "Content-Type: application/json" \
Static analysis
No suspicious patterns detected.