jupyter-live-kernel
Fail
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONCREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: Fetches the
hamelnbtoolset from an external GitHub repository (https://github.com/hamelsmu/hamelnb.git) and executes its scripts using theuv runcommand. - [EXTERNAL_DOWNLOADS]: Clones external code into the local environment from a non-whitelisted source.
- [COMMAND_EXECUTION]: Executes shell commands to launch a background JupyterLab instance and perform API calls using
curl. - [DYNAMIC_EXECUTION]: Provides functionality to execute arbitrary Python code strings in a stateful live kernel.
- [CREDENTIALS_UNSAFE]: Recommends starting the Jupyter server with authentication disabled (
--IdentityProvider.token='' --ServerApp.password=''), which allows unauthenticated access to the kernel and the underlying system resources. - [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: Processes notebook data from
.ipynbfiles via thecontentsandexecutecommands. - Boundary markers: None; code from notebook cells or external strings is executed without validation.
- Capability inventory: Execution of arbitrary Python code, local file system manipulation, and local network operations via the Jupyter API.
- Sanitization: Lacks sanitization or validation of the code extracted from notebook files or provided as input.
Recommendations
- AI detected serious security threats
Audit Metadata