jupyter-notebook-writing
Pass
Audited by Gen Agent Trust Hub on Mar 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of multiple third-party Python libraries, including 'pymilvus', 'langchain', and 'bs4'. It also utilizes the 'jupyter-switch' package from PyPI via the 'uvx' tool to convert files between Markdown and Jupyter Notebook formats.
- [COMMAND_EXECUTION]: The workflow involves executing local system commands to manage the conversion and execution of notebooks, specifically 'uvx jupyter-switch' and 'jupyter execute'. These are standard development operations but represent a capability for local code execution.
- [PROMPT_INJECTION]: The skill's reference materials define a tutorial format for building Retrieval-Augmented Generation (RAG) systems. This architecture ingests untrusted data from external URLs using 'WebBaseLoader' and interpolates it into a prompt template. While the provided template uses '' and '' tags as boundary markers, the absence of explicit sanitization for the ingested web content presents a surface for indirect prompt injection.
- Ingestion points: 'WebBaseLoader' in 'references/bootcamp-format.md' fetches content from external GitHub and personal blogs.
- Boundary markers: The prompt template in 'references/bootcamp-format.md' uses XML-style tags to delimit context.
- Capability inventory: The skill performs file conversion, database operations via 'MilvusClient', and notebook execution via 'jupyter execute'.
- Sanitization: No explicit filtering or sanitization of the scraped data is documented before it is passed to the LLM.
Audit Metadata