Yum NoteBook

• Outcome: Review
• Latest audit: May 28, 2026 · 10:49 AM UTC
• Version: 0.1.1

Overview

Yum NoteBook is a disclosed notebook-generation skill with optional external AI, audio, upload, webhook, and chat delivery integrations.

Before installing, review config.yaml and keep upload.provider, notify.webhook_url, deliver.provider, and external AI providers disabled for private material unless you intend to send content out. Only use trusted values for ai.cli.command, --fetcher, rclone_bin, deliver.openclaw.binary, and upload.onedrive_graph.uploader_path, because those can run local programs or Python code under your account. Install current patched dependencies or use a lockfile for safer deployments.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (17)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def complete(self, system: str, user: str) -> str:
        prompt = f"<system>\n{system}\n</system>\n\n<user>\n{user}\n</user>\n"
        try:
            r = subprocess.run(self.cmd, input=prompt, capture_output=True,
                               text=True, encoding="utf-8", timeout=self.timeout)
        except subprocess.TimeoutExpired as e:
            raise AIError(f"CLI provider timed out after {self.timeout}s: {e}")

• Confidence: 92% confidence
• Finding: The CLI provider executes an arbitrary external command from configuration and passes model prompts to it. Although `shell=True` is not used, this still creates a command-execution boundary where sensitive notebook contents may be sent to any local or remote-capable binary, which is risky in an agent skill that may process untrusted source material.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if (not html or "<title>" not in html.lower()) and fetcher:
        try:
            out = subprocess.run(fetcher.split() + [url], capture_output=True, text=True, encoding="utf-8", timeout=60)
            if out.returncode == 0 and out.stdout:
                html = out.stdout
        except Exception as e:

• Confidence: 95% confidence
• Finding: The URL ingestion fallback executes a user-supplied external command from the --fetcher argument via subprocess.run(). Although shell=True is not used, this still permits arbitrary local program execution with the privileges of the agent process, which exceeds normal URL fetching behavior and can be abused for code execution, file access, or persistence if an attacker can influence arguments or trick a user/agent into using a malicious fetcher.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

with open(list_path, "w", encoding="utf-8") as f:
        for p in input_files:
            f.write(f"file '{os.path.abspath(p).replace(chr(39), '_')}'\n")
    subprocess.run([
        _ffmpeg(), "-y", "-f", "concat", "-safe", "0", "-i", list_path,
        "-codec:a", "libmp3lame", "-b:a", "128k", "-ar", "44100", "-ac", "2",
        output_mp3,

• Confidence: 84% confidence
• Finding: The ffmpeg concat demuxer is invoked with `-safe 0` and consumes a generated manifest that includes file paths influenced by inputs such as `custom_jingle_mp3` and output locations. Although single quotes are replaced, newline and special-path handling are not robust, so an attacker controlling a path could inject additional concat entries or cause ffmpeg to read unintended local files during processing.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill advertises substantial capabilities—environment access, file read/write, network, and shell execution—yet declares no permissions or safety boundaries. In a skill that ingests arbitrary URLs/files and can upload artifacts externally, this under-specification can cause users or orchestrators to invoke it without understanding the real trust and data-exposure implications.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: This file intentionally supports arbitrary external CLI agents, which extends the skill from summarization into unrestricted tool execution. In the context of an agent-integrated notebook skill, that is a meaningful security risk because captured content and prompts can be routed to any configured executable without code-level safeguards or trust enforcement.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: This code path broadens a summarization tool into a general command-execution wrapper by allowing arbitrary external commands during URL ingestion. In an agent setting, where parameters may come from prompts or untrusted workflows, this creates a direct path to execute attacker-chosen local binaries under the agent's privileges.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The code allows config-controlled extra_args to be appended to the rclone command with no allowlist or validation. In an agent skill context, configuration may be influenced by untrusted users or workflows, enabling behavior beyond simple uploads, such as altering destinations, filters, config paths, logging locations, or other side effects through rclone flags.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The invocation examples include broad natural-language triggers such as 'help me understand this article,' which overlap with ordinary assistant requests. That can cause accidental invocation of a high-capability skill, leading to unintended fetching of external content, local file processing, artifact generation, or outbound posting.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill describes webhook notifications and cloud/IM delivery of generated outputs but does not prominently warn that source-derived content, summaries, transcripts, MP3s, slides, and share links may be transmitted to third-party services. Because the tool processes potentially sensitive URLs, screenshots, and local files, insufficient disclosure increases the risk of unintentional exfiltration and privacy or compliance violations.

Missing User Warnings

Medium

• Confidence: 78% confidence
• Finding: The CLI provider forwards prompt contents to an external subprocess without any trust prompt or user-facing disclosure in this code path. In this skill, prompts may contain scraped pages, screenshots, or transcripts, so silent handoff to an arbitrary binary meaningfully increases confidentiality and data-handling risk.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The publish flow can upload generated artifacts, post webhooks, and deliver files/messages to external services automatically, including as part of auto mode, without an execution-time confirmation barrier. In a local-first notebook tool, this increases the chance of unintended data exfiltration of summaries, transcripts, slides, or audio derived from sensitive source material.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: URL ingestion makes outbound network requests to arbitrary URLs and may additionally invoke an external fetcher, but the CLI does not present a clear warning at the point of execution. In agent workflows, this can trigger unexpected network access to attacker-controlled endpoints and, with the fetcher option, escalate to local command execution or SSRF-like access to internal resources.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This module sends arbitrary input text to Microsoft's online edge-tts service, creating a real data-exfiltration/privacy risk if users process sensitive notes, screenshots, transcripts, or source-derived content. In this skill's context, the notebook may contain confidential material gathered from URLs, videos, or local captures, which makes silent third-party transmission more dangerous.

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High

• Category: Supply Chain
• Confidence: 88% confidence
• Finding: The requirements allow `requests` versions with known advisories, and this skill explicitly fetches arbitrary web URLs and likely performs network operations against user-supplied destinations. In that context, a vulnerable `requests` version can expose credentials, mishandle redirects or verification behavior, and increase SSRF or data-leak risk when processing attacker-controlled URLs.

Known Vulnerable Dependency: PyYAML — 8 advisory(ies): CVE-2019-20477 (Deserialization of Untrusted Data in PyYAML); CVE-2020-1747 (Improper Input Validation in PyYAML); CVE-2020-14343 (Improper Input Validation in PyYAML) +5 more

Critical

• Category: Supply Chain
• Confidence: 96% confidence
• Finding: Allowing vulnerable `PyYAML` versions is dangerous because PyYAML has a history of unsafe deserialization issues that can lead to code execution or serious input-processing flaws when untrusted YAML is parsed. This skill is configurable and integrates with multiple cloud destinations and notifications, so configuration parsing is likely; if any YAML inputs are user- or environment-controlled, the impact can be severe.

Known Vulnerable Dependency: yt-dlp — 7 advisory(ies): CVE-2023-46121 (yt-dlp Generic Extractor MITM Vulnerability via Arbitrary Proxy Injection); GHSA-3v33-3wmw-3785 (yt-dlp has dependency on potentially malicious third-party code in Douyu extract); CVE-2023-40581 ( yt-dlp on Windows vulnerable to `--exec` command injection when using `%q`) +4 more

High

• Category: Supply Chain
• Confidence: 91% confidence
• Finding: `yt-dlp` has known security issues and this skill directly ingests YouTube/video/web content, making the dependency highly exposed to attacker-controlled inputs. Vulnerabilities in extractors, proxy handling, or command execution paths can be especially dangerous in an agent environment that automatically processes remote media and metadata.

Known Vulnerable Dependency: Pillow — 10 advisory(ies): CVE-2016-2533 (Pillow buffer overflow in ImagingPcdDecode); CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2021-27922 (Pillow Uncontrolled Resource Consumption) +7 more

Critical

• Category: Supply Chain
• Confidence: 93% confidence
• Finding: Pillow processes attacker-influenced image content, and this skill explicitly handles screenshots and converts images for slide generation, so vulnerable Pillow versions are directly in the attack path. Historical Pillow issues include memory corruption, denial of service, and in some cases code execution, making this especially dangerous for a tool that ingests arbitrary visual media.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: yumnb/upload.py:62