Security audit

Notebook

Security checks for vulnerabilities and agentic risk

Overview

Notebook is a coherent local note tool, but its type names can escape the intended data folder and create, modify, or delete files outside the notebook area.

Install only if you are comfortable with a review-needed local file tool. Keep notebook data in a low-privilege workspace, avoid untrusted type names or imported notebook files, and update the dependency versions before relying on it for important notes.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

Location: lib/store.js:159
Finding: Path Traversal Through Unvalidated Object Type Names
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The skill advertises a notebook delete typename title command without warning about destructive behavior or requiring confirmation expectations. In a local-first knowledge base, accidental deletion could permanently remove user notes, tasks, or linked records, especially if the agent executes user requests too eagerly.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: js-yaml==4.1.1 — 4 advisory(ies): CVE-2026-84375 (js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources); CVE-2026-59869 (js-yaml: YAML merge-key chains can force quadratic CPU consumption); GHSA-5p4m-2wfm-xmqj (JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026) +1 more

High

Category: Supply Chain
Confidence: 98% confidence
Finding: The package declares js-yaml 4.1.1, which is flagged with multiple advisories involving CPU exhaustion during YAML parsing. This skill is explicitly YAML-based, so vulnerable parsing is central to its functionality and could allow maliciously crafted notebook files to trigger denial of service when opened or processed.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: uuid==13.0.0 — 1 advisory(ies): CVE-2026-41907 (uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided)

Low

Category: Supply Chain
Confidence: 83% confidence
Finding: The declared uuid 13.0.0 version is reported as affected by a bounds-check issue when buffer arguments are supplied to certain UUID generation functions. The impact is lower because exploitation depends on the application actually calling the affected APIs with attacker-influenced buffer parameters, which is not evident from package.json alone.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.