Nb

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:47 AM UTC
• Version: 1.0.2

Overview

This nb helper is mostly a straightforward CLI reference, but it includes a contradictory direct-write Git workflow that could commit or sync unintended notebook files.

Install only if you are comfortable letting the agent operate on your nb notebooks. Prefer the nb CLI examples such as nb add, nb edit, nb delete with confirmation, nb git checkpoint, and nb sync; avoid the manual cp into ~/.nb and git add . workflow. Review remotes before syncing, avoid storing secrets in notebooks that may be committed, and ask the agent to show staged changes before any manual Git commit.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:225
• Finding: Unsafe Direct Repository Modification and Broad Git Staging## Vulnerability Details **File Location**: `SKILL.md`, lines 225–227; conflicting safety guidance appears at line 16 **Vulnerability Type**: Unsafe file handling and overly broad Git staging **Risk Level**: Medium ### Vulnerable Code ```bash # Write content to temp file first, then copy to nb cp /tmp/note.md ~/.nb/<notebook>/ cd ~/.nb/<notebook> && git add . && git commit -m "Add note" nb <notebook>: index rebuild ``` The workflow also contradicts the explicit instruction at line 16: ```markdown > ⚠️ **IMPORTANT:** Never edit files in nb git repos (`~/.nb/*`) by hand! Always use the `nb` CLI to ensure proper indexing and Git commits. ``` ### Technical Analysis The documented workflow copies a predictable temporary file directly into an internal `nb` Git repository, bypassing the recommended `nb` interface. This can undermine assumptions about indexing, validation, naming, and automatic commit behavior. More importantly, `git add .` stages every changed or untracked file under the notebook repository rather than only the newly imported note. Any unrelated file already present in the repository can therefore be included in the resulting commit. If notebook synchronization is configured, the documented `nb sync` operation can subsequently transmit that committed content to the configured remote. Using a fixed shared path such as `/tmp/note.md` is also unsafe in multi-user or adversarial environments when another process can replace or manipulate the source before it is copied. ### Attack Path 1. A sensitive, unrelated, or attacker-controlled file is present in the target notebook repository, or an attacker able to manipulate the shared temporary directory replaces `/tmp/note.md`. 2. The user or agent follows the documented import workflow. 3. `cp` directly inserts the selected temporary content into the notebook repository. 4. `git add .` stages all modifications and untracked files in that repository, including unrelated content. 5. `git commit` record ...[truncated 843 chars]
• Remediation: ## Remediation Suggestions 1. Replace the direct-copy workflow with the supported `nb` import command, such as the already documented `nb add` interface. 2. Do not use `git add .` for single-note imports. If direct Git interaction is unavoidable, stage only the intended path: ```bash git add -- "exact-note-file.md" ``` 3. Create temporary files securely with `mktemp`, restrictive permissions, and cleanup traps rather than using a predictable shared filename. 4. Validate that the source and destination are regular files and that the resolved destination remains inside the intended notebook. 5. Review staged changes with `git diff --cached --name-only` before committing. 6. Avoid direct edits to `~/.nb/*` so that validation, indexing, and commit behavior remain controlled by the `nb` CLI. 7. Before synchronization, inspect repository history and staged or committed files to prevent unintended remote disclosure.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The instructions recommend manually copying content into ~/.nb/<notebook>/, then using raw git add/commit and index rebuild steps. This bypasses the intended application interface and safety controls, and because these notes are Git-backed and may be synced remotely, malformed or sensitive content can be committed and propagated widely.

Session Persistence

Medium

• Category: Rogue Agent

Content

# Switch to a notebook
nb use <notebook>

# Create a new notebook
nb notebooks add <name>

# Show current notebook

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: Documenting nb delete <id> -f without an adjacent warning normalizes irreversible deletion that bypasses confirmation prompts. In an agent-assisted context, this increases the chance of accidental destructive actions against user notes, especially if the agent follows examples literally.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The skill explicitly warns users not to edit files in ~/.nb/* by hand, then later instructs them to copy files directly into the nb repository and run git commands manually. This contradiction can bypass nb's indexing and metadata handling, leading to repository inconsistency, broken note state, or accidental corruption of the notebook store.

Ssd 3

Medium

• Confidence: 80% confidence
• Finding: The documented workflow creates a straightforward path for user-provided note content to be copied into a Git-backed store and later synced to remotes. In a note-taking skill this is contextually expected, but the lack of privacy/sync warnings means users may unintentionally place sensitive data into persistent version history and remote repositories.

Static analysis

No suspicious patterns detected.