Security audit

Qa Notebooklm Api

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent NotebookLM helper, but it may route broad summarization or study-material requests into an authenticated external service without enough disclosure or user control.

Review before installing. Use this only when you intentionally want an agent to operate NotebookLM through the third-party CLI. Install it in an isolated environment, verify the package source, avoid uploading secrets or confidential documents unless approved, and confirm before creating notebooks, adding sources, or downloading generated files.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:10
Finding: Unpinned Third-Party Package Installation
Content: View full analysis
Remediation: View remediation
``` 2. Require cryptographic hash verification. Maintain a requirements file containing exact versions and hashes, then install it with: ```bash python -m pip install --require-hashes -r requirements.txt ``` 3. Lock all transitive dependencies rather than pinning only the direct package. Regenerate the lock file through a controlled dependency-review process. 4. Verify that the PyPI package publisher and release artifacts correspond to the referenced source repository. Document explicitly that this is a third-party CLI rather than an official Google package unless official status can be independently established. 5. Install and execute the CLI in an isolated virtual environment or container using a non-privileged account. Do not recommend installation with `sudo` or into a privileged system Python environment. 6. Review new package releases before updating the pinned version. Include source review, dependency-diff review, malware scanning, and provenance or signature verification where available. 7. Minimize credential exposure by restricting filesystem permissions around authentication state and by avoiding environments containing unrelated secrets. 8. Apply the same hardened installation instructions consistently in both `SKILL.md` and `references/quick-ref.md`. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The activation text is broad enough that the skill may trigger on general requests about summarizing, study materials, or notebooks without clear user intent to use NotebookLM. That can cause unintended routing into a tool-backed skill that may send content to an external service or perform account actions when the user did not explicitly ask for that integration.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill instructs adding raw text or URLs as sources but does not disclose that this content is transmitted to the external NotebookLM service. Users may provide sensitive notes, internal documents, or private links under the assumption that processing is local, creating a real privacy and data-handling risk in a skill whose main purpose is content ingestion.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 76% confidence
Finding: The example command 'Summarize this content in Chinese' introduces a specific language output preference without any note that language should follow user choice. While only an example, it may encourage fixed-language behavior rather than explicit user-selected locale handling.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The skill includes commands to download generated artifacts to the local system without warning the user that files will be written locally. While lower risk than external upload, this can still create unwanted local persistence of potentially sensitive derived content or clutter/downloads in environments where file writes should be explicit.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.