T08 · Insecure Dependencies
Error
- Location
- SKILL.md:5
- Finding
- Unofficial Third-Party Dependency Handles Reusable Google Session Credentials<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:5-8, 24, 54-55, 71-82` **Vulnerability Type**: Supply-chain exposure involving a credential-bearing dependency **Risk Level**: High ### Vulnerable Code ```yaml compatibility: Needs Python 3.10+ and `notebooklm-mcp-cli` (`uv tool install notebooklm-mcp-cli` or `pipx install notebooklm-mcp-cli`), providing the `nlm` and `notebooklm-mcp` binaries. Auto auth mode needs a Chromium-family browser (Chrome/Chromium/Brave/Edge/Arc) or Firefox installed. ``` ```markdown Google NotebookLM has no official API. The `notebooklm-mcp-cli` package (`nlm` CLI + `notebooklm-mcp` server) is a **third-party, unofficial client** that authenticates by extracting **browser cookies** from a logged-in Google session and caching them. ``` ```bash # Option 1: uv (recommended) uv tool install notebooklm-mcp-cli==<VERSION> # Option 2: pipx pipx install notebooklm-mcp-cli==<VERSION> # Option 3: pip (only in a virtual environment; avoid --user) pip install notebooklm-mcp-cli==<VERSION> ``` ### Technical Analysis The Skill requires executable code that is not included in the audited project. It explicitly describes that dependency as an unofficial client and grants it access to reusable Google session cookies, NotebookLM data, and the local MCP execution environment. Version pinning limits unexpected upgrades but does not establish that the package artifact is trustworthy. The documentation tells users to replace `<VERSION>` with a stable version obtained from the package index, but it does not provide a reviewed version, artifact hash, signature, lockfile, or source-to-wheel provenance verification. Consequently, the effective executable payload cannot be fully assessed from this repository. This creates a high-impact supply-chain trust boundary because the external package is responsible for extracting, reading, storing, refreshing, and using credentials equivalent to an authenticated Google session. ### Attack P ...[truncated 1222 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Select and document a specific reviewed release rather than instructing users to select the latest stable release dynamically. 2. Pin the exact artifact using cryptographic hashes in a lockfile or requirements file, for example with `--require-hashes`. 3. Verify package ownership, repository provenance, release signatures, and correspondence between the reviewed source and the published wheel. 4. Vendor or independently audit the authentication and credential-storage portions of the dependency. 5. Run the MCP server in a sandbox with: - Access only to its dedicated authentication directory. - No access to unrelated home-directory files. - Network egress restricted to required Google/NotebookLM endpoints. - No root or elevated privileges. 6. Use a dedicated Google account or minimally privileged profile where operationally possible. 7. Document a dependency update review process and do not automatically accept new package versions. ]]>