open-notebook

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt shows and requires sending raw API keys/encryption keys (e.g., "api_key": "sk-..." and OPEN_NOTEBOOK_ENCRYPTION_KEY="your-secret-key-here") in example requests and environment setup, which forces the agent to handle and potentially output secret values verbatim.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required runtime workflow for this skill includes ingesting user-supplied web URLs via POST /api/sources (e.g., url in scripts/source_ingestion.py), which causes the backend to fetch and extract outsider-authored page text and then include it in the LLM chat context during POST /api/chat/execute when include_sources is enabled.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The Quick Start fetches and runs remote deployment artifacts (curl https://raw.githubusercontent.com/lfnovo/open-notebook/main/docker-compose.yml followed by docker-compose up which pulls and runs images such as ghcr.io/lfnovo/open-notebook:latest and surrealdb/surrealdb:latest), so remote content is fetched at setup/runtime and used to execute code/containers.