Nb

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:47 AM UTC
• Version: 1.0.2

Overview

This nb helper is mostly a straightforward CLI reference, but it includes a contradictory direct-write Git workflow that could commit or sync unintended notebook files.

Install only if you are comfortable letting the agent operate on your nb notebooks. Prefer the nb CLI examples such as nb add, nb edit, nb delete with confirmation, nb git checkpoint, and nb sync; avoid the manual cp into ~/.nb and git add . workflow. Review remotes before syncing, avoid storing secrets in notebooks that may be committed, and ask the agent to show staged changes before any manual Git commit.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:225

Finding

Unsafe Direct Repository Modification and Broad Git Staging

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 225–227; conflicting safety guidance appears at line 16
Vulnerability Type: Unsafe file handling and overly broad Git staging
Risk Level: Medium

Vulnerable Code

bash

# Write content to temp file first, then copy to nb
cp /tmp/note.md ~/.nb/<notebook>/
cd ~/.nb/<notebook> && git add . && git commit -m "Add note"
nb <notebook>: index rebuild

The workflow also contradicts the explicit instruction at line 16:

markdown

> ⚠️ **IMPORTANT:** Never edit files in nb git repos (`~/.nb/*`) by hand! Always use the `nb` CLI to ensure proper indexing and Git commits.

Technical Analysis

The documented workflow copies a predictable temporary file directly into an internal nb Git repository, bypassing the recommended nb interface. This can undermine assumptions about indexing, validation, naming, and automatic commit behavior.

More importantly, git add . stages every changed or untracked file under the notebook repository rather than only the newly imported note. Any unrelated file already present in the repository can therefore be included in the resulting commit. If notebook synchronization is configured, the documented nb sync operation can subsequently transmit that committed content to the configured remote.

Using a fixed shared path such as /tmp/note.md is also unsafe in multi-user or adversarial environments when another process can replace or manipulate the source before it is copied.

Attack Path

1. A sensitive, unrelated, or attacker-controlled file is present in the target notebook repository, or an attacker able to manipulate the shared temporary directory replaces /tmp/note.md.
2. The user or agent follows the documented import workflow.
3. cp directly inserts the selected temporary content into the notebook repository.
4. git add . stages all modifications and untracked files in that repository, including unrelated content.
5. git commit record ...[truncated 843 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the direct-copy workflow with the supported nb import command, such as the already documented nb add interface.

2. Do not use git add . for single-note imports. If direct Git interaction is unavoidable, stage only the intended path:

   bash

   git add -- "exact-note-file.md"
   

3. Create temporary files securely with mktemp, restrictive permissions, and cleanup traps rather than using a predictable shared filename.

4. Validate that the source and destination are regular files and that the resolved destination remains inside the intended notebook.

5. Review staged changes with git diff --cached --name-only before committing.

6. Avoid direct edits to ~/.nb/* so that validation, indexing, and commit behavior remain controlled by the nb CLI.

7. Before synchronization, inspect repository history and staged or committed files to prevent unintended remote disclosure.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The instructions recommend manually copying content into ~/.nb//, then using raw git add/commit and index rebuild steps. This bypasses the intended application interface and safety controls, and because these notes are Git-backed and may be synced remotely, malformed or sensitive content can be committed and propagated widely.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

md

# Switch to a notebook
nb use <notebook>

# Create a new notebook
nb notebooks add <name>

# Show current notebook

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Documenting nb delete -f without an adjacent warning normalizes irreversible deletion that bypasses confirmation prompts. In an agent-assisted context, this increases the chance of accidental destructive actions against user notes, especially if the agent follows examples literally.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill explicitly warns users not to edit files in ~/.nb/* by hand, then later instructs them to copy files directly into the nb repository and run git commands manually. This contradiction can bypass nb's indexing and metadata handling, leading to repository inconsistency, broken note state, or accidental corruption of the notebook store.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The documented workflow creates a straightforward path for user-provided note content to be copied into a Git-backed store and later synced to remotes. In a note-taking skill this is contextually expected, but the lack of privacy/sync warnings means users may unintentionally place sensitive data into persistent version history and remote repositories.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.