open-notebook
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documentation instructs the user to download a configuration file from a remote GitHub repository to set up the environment.
- Evidence:
curl -o docker-compose.yml https://raw.githubusercontent.com/lfnovo/open-notebook/main/docker-compose.ymlinSKILL.md. - [INDIRECT_PROMPT_INJECTION]: The skill allows the ingestion of external web content and uploaded documents, which serves as a surface for indirect prompt injection attacks.
- Ingestion points: The
sourcesAPI endpoint is used to ingest content from URLs and uploaded files inSKILL.md,references/api_reference.md, andscripts/source_ingestion.py. - Boundary markers: No explicit boundary markers or instructions to ignore embedded instructions are provided when processing external data.
- Capability inventory: The skill performs network operations using the
requestslibrary to interact with the Open Notebook server API. - Sanitization: No content sanitization or validation mechanisms are described in the provided skill files.
Audit Metadata