NotebookLM RAG Line

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:11 AM UTC
• Version: 1.0.0

Overview

This skill mostly matches its stated NotebookLM-to-RAG purpose, but it should be reviewed because it auto-installs an unpinned browser automation package and uses an authenticated Chrome profile.

Install only after pinning dependencies, removing runtime pip installation, and using a dedicated Chrome profile with no unrelated sessions. Treat NotebookLM answers as potentially sensitive, define retention/deletion for the SQLite and JSON outputs, and do not expose the localhost RAG server or LINE bridge without authentication, request limits, and prompt-injection hardening.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: rag_enhance.py:114

Finding

Automatic Installation of an Unpinned Third-Party Dependency

Content

View full analysis

Remediation

View remediation

\ --hash=sha256: ``` ```bash python -m pip install --require-hashes -r requirements.txt ``` 4. Install dependencies in an isolated virtual environment during a separate deployment step. 5. Use only a trusted package index and explicitly control index configuration in automated deployments. 6. Generate and review a software bill of materials, and scan pinned dependencies for known vulnerabilities. 7. Update the installation commands in `README.md` and `SKILL.md` so they use the same pinned and hash-verified dependency set. 8. Run browser automation under a dedicated, least-privileged operating-system account and a dedicated browser profile containing no unrelated sessions. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: rag_server.py:51

Finding

Indirect Prompt Injection Through Untrusted Query, History, and RAG Content

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (16)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

This second mismatch finding points to the same underlying issue: the skill claims automated knowledge synchronization but the markdown primarily describes a query-driven RAG workflow. Misrepresentation of functionality is dangerous because reviewers may approve broader data access or automation under false assumptions about what is actually synchronized or exposed.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

This second mismatch finding points to the same underlying issue: the skill claims automated knowledge synchronization but the markdown primarily describes a query-driven RAG workflow. Misrepresentation of functionality is dangerous because reviewers may approve broader data access or automation under false assumptions about what is actually synchronized or exposed.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill advertises capabilities that imply shell execution, network access, and local file/database writes, but it does not declare any explicit tool scope or permissions boundary. This increases the risk of over-privileged execution, because users and platforms cannot easily constrain what the skill may access before installation or runtime.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill describes automated extraction of NotebookLM answers into a local SQLite RAG database but does not prominently warn that NotebookLM content may contain sensitive or proprietary information. Persisting such content locally can create unintended retention, secondary exposure, and compliance issues if users assume the process is harmless synchronization.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The documentation mentions LINE notifications and bot replies without clearly disclosing that data may be transmitted to external/networked services. Users may unknowingly expose question content, answers, identifiers, or operational metadata to third-party platforms, especially in educational or support contexts where personal data may appear.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Question and answer content is sent to a local HTTP embedding service without an explicit disclosure or consent boundary. While the destination is localhost, the content may still be sensitive, and local services can be exposed indirectly, logged, or proxied in ways the user does not expect.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Self-installing patchright at runtime adds software-management behavior beyond the core NotebookLM-to-RAG workflow. This is risky because it silently changes the system state and can pull unreviewed code into the execution environment, which is especially sensitive in an automation skill with browser access.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 95% confidence

Finding

The script invokes pip at runtime to install a package automatically. Even though the command is fixed and not shell-injected, this expands the skill's capabilities to modify the host environment and introduces supply-chain risk if package resolution is tampered with or an unexpected version is fetched.

Content

Scanner excerpt · rag_enhance.py (reported line 124)May include surrounding context.

python

from patchright.sync_api import sync_playwright
        except ImportError:
            log("patchright not installed, installing...")
            subprocess.run([sys.executable, "-m", "pip", "install", "patchright"], check=True)
            from patchright.sync_api import sync_playwright

        if not os.path.exists(CHROME_PROFILE):

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest's primary claim is automatic synchronization of NotebookLM knowledge into a LINE RAG knowledge base. This file only reads an existing SQLite embedding store, computes similarity, and queries local model endpoints to answer questions; it contains no logic to connect to NotebookLM, fetch source knowledge, or perform synchronization.

Content

No source excerpt is available for this finding.

Ssd 4

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The server concatenates user-controlled history, retrieved knowledge, and the latest question into a single user message without clear role isolation or prompt-hardening. This allows prompt injection and conversation-steering attacks, where a user can override intended behavior, manipulate retrieval context usage, or coerce the model into ignoring instructions and generating unsafe or misleading outputs; in this skill context, that is more dangerous because the bot is presented as a knowledge-backed assistant, so users may over-trust manipulated responses.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest describes a skill for synchronizing NotebookLM knowledge into a LINE AI assistant RAG knowledge base, with automatic Q&A and follow-up suggestions. In code, the main behavior here is not synchronization at all; it performs runtime answer generation with a hardcoded persona and explicitly addresses the user as a customer, which is a materially different operational scope from the stated sync-oriented purpose.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The prompt hard-codes '請用繁體中文回答', which imposes a specific language/locale on every response. The file does not indicate any user opt-in or region-specific justification for this constraint, so it is a natural-language locale policy violation under the stated rules.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill documentation is written entirely in Traditional Chinese and does not indicate that language selection is optional or that the skill is intended only for a Chinese-speaking audience. Under the policy, forcing a specific language without user opt-in can be a locale/language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The natural-language instructions and descriptions in the docstring are exclusively in Traditional Chinese, with no indication that other languages are supported or that the user can choose their preferred language. Under the stated policy, forcing a specific language without opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The manifest focuses on syncing NotebookLM knowledge into a LINE AI assistant's RAG knowledge base. In addition to database insertion, the script also persists a separate JSON file containing the collected Q&A results, which is an extra storage/export behavior not described as part of the skill's scope.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This code persists gathered question/answer results to OUTPUT_FILE as JSON, which may store sensitive or proprietary content. Although the path is configurable and a save log is printed afterward, there is no prior disclosure or warning in the script documentation that responses will be written to a local file.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.