A command linker is a JupyterLab feature that converts certain links or link-like UI elements into executable commands inside the application. Instead of opening a normal web page, the click routes to a registered command, such as opening a panel, launching a tool, or changing workspace state.
This matters because it blurs the line between content and action. If untrusted Markdown, rendered output, or injected HTML can create or influence command links, a user may trigger actions they did not intend. In a security review, defenders look for whether command-link behavior is restricted to trusted sources, whether commands require explicit user confirmation, and whether extension or content controls block abuse. In attacks, the risk is not always direct code execution; it can also be unauthorized configuration changes, workflow disruption, or stepping stones toward broader abuse of the notebook environment.