T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/notion_db_weekly_report_generator.py:59- Finding
Unescaped Record Data Allows Markdown Content Injection
- Content
View full analysis
- Remediation
View remediation
Security audit
Notion DB Weekly Report Generator
Security checks for vulnerabilities and agentic risk
Overview
This weekly report skill is functional, but it should go to Review because it automatically adds payment links and ships billing-contract material that is not clearly scoped to report generation.
Review this skill before installing. It appears to run locally and generate weekly report markdown, but users should be aware that normal output includes monetization metadata and a payment link, and the package contains billing-contract documentation that is broader than the report task. Only use it where the payment-link behavior is desired, and avoid rendering reports from untrusted task records in permissive Markdown viewers without sanitization.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/notion_db_weekly_report_generator.py:19- Finding
Unencoded User Identifier Allows Payment URL Query Manipulation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (8)
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This file documents a billing/charge workflow for a skill whose stated purpose is only weekly report generation, creating a strong capability-purpose mismatch. Even as reference documentation, it normalizes collection of payment data and top-up flows that are unrelated to the declared function, which can enable unauthorized charging logic, hidden monetization, or expansion into financial handling without clear user consent or architectural justification.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Including payment processing capability in a basic weekly report generator is dangerous because it introduces a sensitive financial action unrelated to the advertised task-processing role. In this context, the mismatch increases suspicion: users and reviewers would not expect charge endpoints, payment URLs, or balance handling in a report formatter, making hidden billing behavior easier to conceal and more damaging if activated.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The title and documented purpose indicate the skill is specifically a Chinese-language weekly report generator ("周报生成器"), but the file does not state that language selection is optional or limited for a justified regional/compliance reason. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill generates payment URLs from untrusted environment configuration and injects monetization logic into a utility whose stated purpose is weekly report generation. This is dangerous because it can redirect users to arbitrary payment endpoints or enable deceptive upsell behavior unrelated to the core function, creating phishing and trust-boundary risks.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Multiple user-facing strings are fixed in Chinese, including default field values, report headings, and the premium-upgrade message. For a general-purpose weekly report generator, this forces a specific language without user opt-in, which matches the locale policy violation criteria.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The code always includes upgrade and payment details in normal successful output, despite the description claiming premium hooks are merely reserved. Exposing monetization metadata in routine responses increases the chance of covert solicitation, social engineering, or downstream UI components presenting unrequested payment prompts to users.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This code hard-codes Chinese titles, owner names, statuses, and later asserts a Chinese markdown heading, which indicates the skill behavior is expected to operate in a single language. For a non-region-specific skill, forcing one locale without opt-in can violate language/locale policy requirements.
- Content