Security audit

NotebookLM CLI

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent NotebookLM CLI wrapper, but it exposes authenticated notebook deletion and public sharing commands without enough safety scoping or privacy warnings.

Review this skill before installing if you use NotebookLM with private, regulated, or business-sensitive material. Only run deletion, sharing, public access, export, and import commands when you have verified the target notebook or recipient and understand the account-level impact.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill instructs users to authenticate to NotebookLM and use a wrapper that sends prompts, notebook content, notes, and related data to an external service, but it does not warn about data transmission, account usage, or sensitivity of uploaded/shared content. This can lead users or downstream agents to send confidential data to a third-party platform without informed consent or appropriate handling controls.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The command catalog documents destructive commands such as `clear` and notebook/source/note/artifact deletion with `--yes` but provides no warning about irreversible data loss or account/session impact. In a CLI wrapper skill, users may copy commands directly, so the omission increases the chance of accidental destructive actions even without an attacker modifying commands.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The sharing section includes commands to add editors, change permissions, and enable public access without any privacy or exposure warning. Because this skill is specifically for notebook and artifact management, users may unintentionally broaden access to potentially sensitive research content, leading to data exposure or unauthorized modification.

Natural-Language Policy Violations

Low

Confidence: 94% confidence
Finding: The example `language set zh_Hans` prescribes a specific locale, and the file does not frame it as optional or provide alternative user-selected language guidance. The policy requires avoiding forced language or locale choices unless the user is given an explicit choice or the constraint is justified.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/notebooklm.mjs:19