Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add PracticalSwan/agent-skills --skill notebook-execution-safetygit clone --depth 1 https://github.com/PracticalSwan/agent-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/practicalswan/agent-skills/notebook-execution-safety)<a href="https://agentmods.dev/skills/practicalswan/agent-skills/notebook-execution-safety"><img src="https://agentmods.dev/badge/skills/practicalswan/agent-skills/notebook-execution-safety/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/practicalswan/agent-skills/notebook-execution-safety"><img src="https://agentmods.dev/badge/skills/practicalswan/agent-skills/notebook-execution-safety.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00027 | $0.00777 |
| Opus 5 | $0.00014 | $0.00388 |
| Sonnet 5 | $0.00005 | $0.00155 |
| Haiku 4.5 | $0.00003 | $0.00078 |
Grade A, and why
notebook-execution-safety scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 83 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Notebook Execution Safety
Use this skill before running, modifying, or debugging .ipynb files.
Workflow
- Read
AGENTS.mdand relevant Serena memory ordocs/memory-bank/fallback context for the target folder. - Read notebook metadata, headings, markdown cells, imports, and code cell summaries.
- Identify cells that perform network access, archive extraction, local file writes, long training runs, package installs, or submission/export steps.
- Ask before executing cells with network, extraction, broad writes, or submission side effects.
- Prefer targeted cell execution or static fixes before full-notebook runs.
- Preserve student work and outputs unless the user asks to clear or rerun them.
- After edits, verify with the narrowest practical execution path.
Reporting
State:
- what was inspected
- whether execution happened
- which cells or notebook path were verified
- what was intentionally not run
Cross-Client Portability
This skill is written to stay usable across GitHub Copilot, Claude Code, and Codex.
- GitHub Copilot: keep the folder in a Copilot-visible skill path or wrap the workflow in project instructions when folder discovery is unavailable.
- Claude Code: keep the folder in a local skills directory or a compatible plugin source.
- Codex: install or sync the folder into
$CODEX_HOME/skills/notebook-execution-safetyand restart Codex after major changes.
MCP Availability And Fallback
Preferred MCP Server: None required
- Fallback prompt: "Use the Notebook Execution Safety skill without MCP. Rely on its local instructions, bundled resources, standard shell or editor tools, and direct verification. Show the evidence used before concluding."
- Do not claim an MCP operation was used when the active host does not expose it.
- Treat local files, tests, rendered outputs, logs, or screenshots as the fallback evidence path.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago Changed 67d88747286a
- 4d ago Changed a652db19a83d
- 7d ago First seen · 83 lines · 27 tokens per session scan A 194ac15c6e79
notebook-execution-safety is a skill published in the GitHub repository PracticalSwan/agent-skills (14 stars, last pushed 3d ago), licensed MIT. It adds 27 tokens to every session and 777 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
trulens-notebook-execution
Execute and display Jupyter notebooks for TruLens demos and quickstarts.
translational-safety
Safety pharmacology assessment, CTCAE grading, organ-specific toxicity biomarkers, CYP liability analysis, structural alerts, and drug-drug interaction evaluation.
template-eda-notebook
Exploratory data analysis notebook exemplar — notebook-to-src extraction workflow, tested EDA library, deterministic dataset, diagnostic figures.
Jupyter Live Kernel
Guides notebook-first analysis with reproducible kernels, inspectable data loading, and explicit promotion paths back into durable code.
admet-prediction
ADMET (Absorption, Distribution, Metabolism, Excretion, Toxicity) prediction for drug candidates. Use for assessing drug-likeness, PK properties, and safety risks early in drug discovery. Keywords: ADMET, PK, toxicity, drug-likeness, DILI, hERG, bioavailability.
target-safety
Target safety assessment including known toxicities, essentiality, and off-target concerns. Use for early safety risk evaluation and target selection. Keywords: target safety, toxicity, essential gene, knockout, safety risks.