kotlin-notebook

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The prompt includes examples that embed plaintext credentials (e.g., @file:Repository("https://private.repo.com/maven", "username", "password")), which encourages putting secrets directly into notebook cells and would require the LLM to output secret values verbatim if used—an insecure pattern.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's required workflows explicitly instruct fetching and loading data and dependencies from public URLs and repos (e.g., DataFrame.readCsv("https://example.com/data.csv"), Ktor http.get("https://api.example.com/data"), @file:Repository / %use / %useLatestDescriptors and URL-based Image()), meaning the agent would ingest untrusted third‑party content (including executable HTML/JS when a notebook is Trusted) that can materially influence execution and subsequent actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill includes runtime @file:Repository entries (e.g., https://repo.maven.apache.org/maven2/ and https://maven.google.com/) alongside @file:DependsOn for artifacts like org.jetbrains.compose:compose-full, which will be fetched at notebook runtime as JARs and executed in the kernel, so these URLs are used to fetch and run remote code.