Security audit
Security checks for vulnerabilities and agentic risk
This notebook helper mostly performs relevant Jupyter tasks, but its public instructions do not match the script and one cleanup path overwrites notebooks by default.
Review before installing. Use this only for explicit notebook tasks, and avoid running notebook execution or cleanup unless you trust the notebook contents and have backups. The publisher should align SKILL.md with the actual commands and make cleanup write to a new file unless the user explicitly asks for in-place modification.
The skill exposes shell-backed commands via scripts/script.sh but does not declare any explicit tool scope such as permissions or allowed-tools. That mismatch can lead to the agent invoking file-modifying behavior without clear policy constraints or user-visible authorization boundaries, increasing the chance of unintended writes or unsafe execution paths.
The manifest advertises operational notebook-management tasks such as converting, extracting, and running notebooks, but the listed commands are only generic topical entries like intro, theory, and references. This inconsistency can mislead an agent or user about what the skill really does, making it harder to assess actual behavior and potentially masking execution or file-handling logic in the referenced script.
The trigger phrases and usage guidance are broad and generic, such as 'run notebook' and 'need quick reference,' which can cause the skill to be selected in situations where it is not necessary or not safe. Over-broad invocation increases the likelihood of unintended shell/script execution and file operations in unrelated contexts.
The clean command defaults to modifying the original notebook in place when no second argument is provided, which can silently destroy outputs and execution metadata that users may expect to preserve. In a notebook-management skill, this is especially risky because users may run cleanup on valuable analysis artifacts and lose reproducibility evidence or results without an explicit confirmation step or safer default.
No suspicious patterns detected.
