Security audit

jupyter-notebook-manager

Security checks for vulnerabilities and agentic risk

Overview

This skill is a notebook creation and execution helper, but it gives an agent high-impact code execution paths with weak scoping and unsafe input handling.

Install only if you will use it on trusted notebooks and trusted parameter values. Review generated notebooks before running them, provide explicit output paths to avoid overwriting originals, and prefer an isolated environment with restricted filesystem and network access.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/notebook_executor.py:138
Finding: Arbitrary Python Code Injection Through Notebook Parameters
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/notebook_creator.py:218
Finding: Arbitrary Python Code Injection Through Notebook Template Fields
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/notebook_executor.py:164
Finding: Predictable Temporary Notebook Path Enables Symlink File Overwrite
Content: View full analysis
` as a symbolic link to another file writable by the executor. Opening the path truncates and overwrites the symlink target with notebook JSON. A race is also possible between path checks and operations because no secure temporary-file primitive or directory descriptor is used. ### Attack Path 1. The attacker has write access to the directory where notebook output will be produced. 2. The attacker predicts the temporary path from the output filename, such as `.tmp_results.ipynb`. 3. The attacker creates that path as a symbolic link to a file writable by the executor account. 4. The executor opens the predictable path with mode `w`. 5. The operating system follows the symbolic link, truncating and replacing the target's contents with notebook JSON. 6. Cleanup may remove the symlink, reducing the visible evidence in the output directory. ### Impact Assessment The vulnerability permits truncation or overwrite of files writable by the executor account. Potential targets include project configuration, source files, user data, or other appl ...[truncated 294 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (35)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description claims a comprehensive notebook management system including creation, execution, debugging, and analysis. The supplied code only implements notebook creation from templates and saving the resulting .ipynb file. While some generated templates contain code cells for analysis or model training, the script itself does not run those notebooks, debug them, inspect existing notebooks, or provide broader management operations. Therefore the description materially overstates the implemented capabilities.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The description significantly overstates the implemented functionality. The supplied code is focused narrowly on executing existing Jupyter notebooks, with timeout handling, optional parameter injection, error detection, and basic output extraction. It does not create notebooks, provide a broader management system, or implement meaningful debugging or analysis capabilities beyond simple error reporting and output summarization. This is a material description-to-behavior mismatch in primary scope and advertised capabilities.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description claims a full notebook management system covering creation, execution, debugging, and analysis. The supplied code chunk is specifically a unit test file for notebook creation functionality. It imports NotebookCreator and checks template-based notebook generation, metadata, JSON validity, output path handling, and related creation features. There is no implementation in this chunk for executing notebooks, debugging them, managing existing notebooks, or performing analysis beyond embedding template text. Because the observed behavior is much narrower and primarily a test harness, the description materially overstates and misrepresents what this code chunk actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The declared description says the skill is a complete Jupyter notebook management system with creation, execution, debugging, and analysis capabilities. However, the supplied code chunk is only a unit/integration test file (tests/test_executor.py). It exercises NotebookExecutor and NotebookCreator, but does not itself provide those management capabilities. Its direct behavior is creating temporary notebooks, invoking executor methods, and asserting expected results. While the tested components appear related to notebook execution and creation, this chunk’s actual role is test automation, not a complete management system. Therefore the description does not accurately represent what this supplied code chunk actually does.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 244)May include surrounding context.
md
- `scripts/notebook_creator.py` - Template-based notebook generation

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 444)May include surrounding context.
md
- `scripts/notebook_creator.py` - Template-based notebook generation

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Running 'jupyter nbconvert --execute' causes all code cells in the notebook to execute, which can perform arbitrary actions such as reading secrets, modifying files, or making network requests. In this skill context, notebook execution is a core feature, so the absence of a prominent safety disclosure and trust boundary makes accidental execution of untrusted notebooks significantly dangerous.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documentation describes executing notebooks and notes that output defaults to overwriting the input notebook, but it does not prominently warn that notebook execution runs arbitrary code and can modify files. In this skill context, that omission is meaningful because Jupyter notebooks are executable artifacts and overwrite behavior can destroy user work or facilitate unsafe execution if a user supplies an untrusted notebook.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The README suggests invoking the skill with very broad natural-language prompts like 'Create a data analysis notebook for my sales data' and 'Run it with my Q4_sales.csv file' without clearly stating when the skill should or should not take control. In an agent environment, vague activation boundaries can cause unintended triggering for ordinary data-assistance requests, leading the agent to create or execute notebooks and handle files when the user may not have intended an execution-capable workflow.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill advertises and instructs use of file read/write and shell-backed notebook operations, but it does not declare any explicit tool scope such as permissions or allowed-tools. In an agent ecosystem, missing scope boundaries can let the skill be invoked with broader-than-expected capabilities, increasing the chance of arbitrary notebook execution, file modification, and shell command use against user data or the host environment.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger conditions are broad enough to activate on generic data-analysis requests, not just explicit notebook management tasks. Overbroad activation can cause the agent to select a high-privilege skill unnecessarily, exposing users to unintended file access, notebook execution, or shell-backed operations in contexts where safer, narrower skills would suffice.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Environment-based activation on merely detecting notebook files in the working directory is ambiguous and can trigger this skill without clear user intent. In a system that can read, write, and execute notebooks, passive discovery-based activation raises the risk of processing sensitive files or running notebooks the user never asked to touch.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The executor defaults to overwriting the input notebook when no output path is provided, and later replaces the destination with the executed temporary notebook. In a notebook-management skill, this can silently destroy the original file, including evidence, comments, metadata, or prior outputs, which is especially risky when operating on user-supplied notebooks.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/notebook_executor.py (reported line 184)May include surrounding context.
python
if verbose: print(f"🔧 Running: {' '.join(cmd)}") result = subprocess.run( cmd, capture_output=True, text=True,

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 95% confidence
Finding: The dependency is specified with only a lower bound, so builds may resolve to different versions over time. This weakens supply-chain control, reduces reproducibility, and can allow vulnerable or incompatible releases to be installed without review.
Content: Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.
text
##Core Dependencies jupyter>=1.0.0 nbformat>=5.0.0 nbconvert>=6.0.0 ipykernel>=6.0.0

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 95% confidence
Finding: Using an unpinned nbformat version means the environment can silently drift to newer releases. That increases supply-chain and reproducibility risk because a future vulnerable or breaking version could be installed unexpectedly.
Content: Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.
text
##Core Dependencies jupyter>=1.0.0 nbformat>=5.0.0 nbconvert>=6.0.0 ipykernel>=6.0.0

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 98% confidence
Finding: nbconvert is unpinned despite being a package with a history of security advisories, including file read/write and XSS issues. Without an exact version, deployments may pull in an affected release, making notebook conversion workflows riskier.
Content: Scanner excerpt · requirements.txt (reported line 4)May include surrounding context.
text
##Core Dependencies jupyter>=1.0.0 nbformat>=5.0.0 nbconvert>=6.0.0 ipykernel>=6.0.0 # Data Science Libraries

Unverifiable Dependency: nbconvert has 8 known advisory(ies) (CVE-2026-39377 (nbconvert has an Arbitrary File Write via Path Traversal in Cell Attachment File); CVE-2026-39378 (nbconvert has an Arbitrary File Read via Path Traversal in HTMLExporter Image Em); CVE-2021-32862 (nbconvert vulnerable to cross-site scripting (XSS) via multiple exploit paths) +5 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 98% confidence
Finding: The manifest references nbconvert without pinning a specific version, and nbconvert has multiple known advisories including path traversal and XSS issues. Because this skill manages notebooks and likely converts or exports them, the context makes uncertain nbconvert versions more dangerous than in a generic project.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 95% confidence
Finding: An unpinned ipykernel dependency allows uncontrolled upgrades that may introduce security flaws or incompatible runtime behavior. In a notebook execution skill, kernel packages are especially sensitive because they sit in the code-execution path.
Content: Scanner excerpt · requirements.txt (reported line 5)May include surrounding context.
text
jupyter>=1.0.0 nbformat>=5.0.0 nbconvert>=6.0.0 ipykernel>=6.0.0 # Data Science Libraries pandas>=1.3.0

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 96% confidence
Finding: pandas is unpinned, so the installed version may vary by install time or mirror state. This creates reproducibility issues and may expose the environment to vulnerable releases or dependency conflicts.
Content: Scanner excerpt · requirements.txt (reported line 8)May include surrounding context.
text
ipykernel>=6.0.0 # Data Science Libraries pandas>=1.3.0 numpy>=1.20.0 matplotlib>=3.3.0 seaborn>=0.11.0

Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 ( DISPUTED pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 84% confidence
Finding: pandas has at least one disputed advisory related to unsafe deserialization, and the manifest does not prove a safe version is installed. The risk is lower than execution-oriented notebook packages, but uncertainty remains because notebooks often load external data and serialized objects.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 96% confidence
Finding: numpy is specified with a lower bound only, which permits unintended upgrades. Since it is a foundational dependency, version drift can propagate risk broadly across the environment.
Content: Scanner excerpt · requirements.txt (reported line 9)May include surrounding context.
text
# Data Science Libraries pandas>=1.3.0 numpy>=1.20.0 matplotlib>=3.3.0 seaborn>=0.11.0 scikit-learn>=1.0.0

Unverifiable Dependency: numpy has 16 known advisory(ies) (CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 90% confidence
Finding: numpy has multiple historical advisories and is not pinned, so affected versions cannot be ruled out. As a core dependency used broadly across the notebook stack, a vulnerable numpy release can expand blast radius across many operations.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 94% confidence
Finding: matplotlib is unpinned, so installations are not deterministic and may consume vulnerable or incompatible releases. While not always directly exploitable, this still weakens supply-chain hygiene.
Content: Scanner excerpt · requirements.txt (reported line 10)May include surrounding context.
text
# Data Science Libraries pandas>=1.3.0 numpy>=1.20.0 matplotlib>=3.3.0 seaborn>=0.11.0 scikit-learn>=1.0.0

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 94% confidence
Finding: seaborn is not version-pinned, which allows dependency drift and reduces confidence in the security and stability of deployed environments. This is a standard supply-chain hardening issue.
Content: Scanner excerpt · requirements.txt (reported line 11)May include surrounding context.
text
pandas>=1.3.0 numpy>=1.20.0 matplotlib>=3.3.0 seaborn>=0.11.0 scikit-learn>=1.0.0 # Advanced Notebook Tools

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

SkillSpector

Tp4

Tp4

Tp4

Tp4

Ae1

Ae1

Missing User Warnings

Missing User Warnings

Vague Triggers

Undeclared Tool Scope

Vague Triggers

Vague Triggers

Missing User Warnings

subprocess module call

Unpinned Dependencies

Unpinned Dependencies

Unpinned Dependencies

Unpinned Dependencies

Unpinned Dependencies

Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Unpinned Dependencies

Unpinned Dependencies

Unpinned Dependencies

Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 ( DISPUTED pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected