open-notebook

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt includes examples that instruct embedding secrets verbatim (exporting an encryption key in a shell command and posting an "api_key" value in a REST request), which requires the LLM to output secret values directly.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). Two URLs point to a personal GitHub repository/raw file that is used to pull a container image from a user namespace (ghcr.io/lfnovo) — downloading and executing containers from an unknown/unverified user can be used to distribute malware, so treat those as suspicious.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Open Notebook’s required runtime workflow ingests outsider-authored free text submitted via its REST API source ingestion endpoints (e.g., POST /api/sources with text/url, then processes extracted full text for chat/search context).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The Quick Start instructs downloading and using https://raw.githubusercontent.com/lfnovo/open-notebook/main/docker-compose.yml (curl ...), which is fetched at setup/runtime and then used with docker-compose up -d to pull/run remote container images (executing remote code).