open-notebook
Warn
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs users to download a
docker-compose.ymlfile from an external GitHub repository (lfnovo/open-notebook) not managed by the skill's maintainer. This file is used to orchestrate the application's entire runtime environment and services. - [COMMAND_EXECUTION]: The documentation provides shell commands for installation and deployment (
curl,docker-compose), allowing for file downloads and container management on the host system. - [INDIRECT_PROMPT_INJECTION]: The skill possesses a significant attack surface for indirect prompt injection as it is designed to ingest and process untrusted external data.
- Ingestion points: External content enters the agent context via the
/api/sourcesendpoint, which accepts web URLs and multipart file uploads (PDF, DOCX, audio, video) as documented inreferences/api_reference.md. - Boundary markers: The instructions do not define boundary markers or delimiters to protect the AI's processing logic from instructions embedded within the ingested documents.
- Capability inventory: The skill has the capability to execute AI-powered content transformations, generate multi-speaker podcast scripts, and store persistent notes in a database based on the processed content.
- Sanitization: There is no documented mechanism for sanitizing or filtering external content before it is processed by the AI models.
Audit Metadata