open-notebook

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The prompt contains examples that embed secrets verbatim (exporting OPEN_NOTEBOOK_ENCRYPTION_KEY and posting "api_key": "sk-...") and instructs adding provider API keys via the REST API or UI, which encourages the LLM/agent to accept and place raw secret values into requests or code—an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly ingests arbitrary public web content via the /api/sources endpoint (SKILL.md and references/examples.md show adding URL sources like arxiv/nature/wikipedia) and then includes those sources as context for /api/chat/execute and /api/search, meaning untrusted third‑party content is read and can directly influence agent outputs and subsequent actions.