Access and manage a self-hosted Open Notebook research system (NotebookLM alternative). Create notebooks, add sources (text/URL/file), cross-notebook search,...
Security Analysis
high confidenceThis skill is mostly coherent, but its provided bridge code does not fully enforce the notebook access controls it promises, which could expose private notes in shared or restricted setups.
The skill's purpose is clear: connect an agent to a self-hosted Open Notebook system for saving, searching, chatting with, and managing research notes. However, private note access plus destructive notebook/source deletion are high-impact capabilities, and the sample bridge leaves cross-notebook list/search paths broader than the documented per-notebook controls.
The SKILL frontmatter says to use it only for explicit saved-content requests, but the README says the agent uses it automatically for broad research or notes prompts. That ambiguity matters because activation can retrieve persisted private notebook data.
Install/setup is disclosed and local: it requires a self-hosted Open Notebook deployment, a local FastAPI bridge on 127.0.0.1:5077, an agent API key, and a user systemd service. No hidden installer or obfuscated package behavior was found.
Loopback-only network access and an API key are proportionate for this integration, but the documented security model depends on per-notebook allowlists that are not consistently applied by the included bridge example.
The bridge is intended to run persistently and logs calls, which is disclosed. The skill also exposes irreversible delete commands without an interactive confirmation step, so users should treat it as a privileged notebook-management tool, not only a search/RAG helper.
Guidance
Install only if you control the Open Notebook deployment and are comfortable giving the agent notebook-management authority. Before using per-notebook restrictions, fix or verify bridge-side enforcement for notebook listing and cross-notebook search, and require explicit user confirmation before delete-source or delete-notebook operations.
Latest Release
v1.3.0
Security audit fixes v2: source ownership enforcement on get-source/delete-source (prevents cross-notebook access), stripped agent count from health endpoint, irreversible operation warnings on delete commands.
More by @crabsticksalad
Published by @crabsticksalad on ClawHub
