T01 · Skill Instruction Hijacking
Error
- Location
scripts/ask_question.py:29- Finding
Agent Instruction and Output Hijacking Through Appended Control Text
- Content
View full analysis
- Remediation
View remediation
Security audit
Notebooklm
Security checks for vulnerabilities and agentic risk
Overview
This skill mostly does what it says, but it stores Google browser session data and gives the agent broad, risky browser and command behavior that users should review before installing.
Install only if you are comfortable with local browser automation using your Google account. Prefer a dedicated Google account, keep the skill directory private, avoid storing it in synced or shared folders, verify NotebookLM URLs before use, and treat cleanup/remove commands as data-deleting operations.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (5)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/run.py:62- Finding
Path Traversal Allows Execution of Python Files Outside the Scripts Directory
- Content
View full analysis
int: """Run a script with the virtual environment""" script_path = self.skill_dir / "scripts" / script_name if not script_path.exists(): print(f"❌ Script not found: {script_path}") return 1 # Ensure venv is set up if not self.ensure_venv(): print("❌ Failed to set up environment") return 1 # Build command cmd = [str(self.venv_python), str(script_path)] if args: cmd.extend(args) print(f"🚀 Running: {script_name} with venv Python") try: # Run the script with venv Python result = subprocess.run(cmd) return result.returncode ``` ### Technical Analysis Both execution paths concatenate an untrusted script name with the nominal `scripts` directory. They verify only ...[truncated 1811 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/ask_question.py:74- Finding
Notebook URL Is Navigated Before Its Origin Is Validated
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/config.py:29- Finding
Chrome Sandbox Is Disabled While Rendering Remote Content
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/auth_manager.py:165- Finding
Google Browser Session State Is Persisted Without Explicit Permission Hardening
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
Findings (49)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared purpose focuses on querying NotebookLM, but the documentation also exposes destructive maintenance actions such as cleanup and notebook removal that can delete local metadata, auth state, or browser/session data. This mismatch is risky because users may authorize or invoke the skill expecting read/query behavior, while the skill also supports state-destructive operations not clearly foregrounded in the top-level description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared purpose focuses on querying NotebookLM, but the documentation also exposes destructive maintenance actions such as cleanup and notebook removal that can delete local metadata, auth state, or browser/session data. This mismatch is risky because users may authorize or invoke the skill expecting read/query behavior, while the skill also supports state-destructive operations not clearly foregrounded in the top-level description.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 97% confidence
- Finding
The explicit
rm ~/.claude/skills/notebooklm/data/library.jsoncommand is a destructive filesystem operation presented as a troubleshooting step without strong safeguards. Because users may execute it directly, it creates a real risk of deleting local state and breaking skill functionality or losing curated notebook metadata.- Content
md cp ~/.claude/skills/notebooklm/data/library.json library.backup.json # Reset library rm ~/.claude/skills/notebooklm/data/library.json # Re-add notebooks python scripts/run.py notebook_manager.py add --url ... --name ...
Unvalidated Output Injection
High
- Category
- Output Handling
- Confidence
- 85% confidence
- Finding
Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.
- Content
python # Query documentation during development def check_api_usage(api_endpoint): result = subprocess.run([ "python", "scripts/run.py", "ask_question.py", "--question", f"Parameters and response format for {api_endpoint}", "--notebook-id", "api-docs"
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The documentation explicitly instructs saving authentication state to
state.jsonand manually re-injecting cookies, but it does not warn that this file likely contains active Google session cookies and other sensitive browser state. If the file is copied, exposed through backups, world-readable permissions, logs, or source control, an attacker may be able to hijack the user's authenticated NotebookLM/Google session.- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
The simplest installation ever:
bash # 1. Create skills directory (if it doesn't exist) mkdir -p ~/.claude/skills # 2. Clone this repository
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 85% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
bash # 1. Create skills directory (if it doesn't exist) mkdir -p ~/.claude/skills # 2. Clone this repository cd ~/.claude/skills
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 85% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
bash # 1. Create skills directory (if it doesn't exist) mkdir -p ~/.claude/skills # 2. Clone this repository cd ~/.claude/skills
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 85% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
Skill not found
bash # Make sure it's in the right location ls ~/.claude/skills/notebooklm/ # Should show: SKILL.md, scripts/, etc.
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill advertises and documents shell execution, file reads, and file writes, but it does not declare any explicit tool scope such as allowed-tools or permissions. That weakens containment and reviewability because consumers cannot easily tell what operational privileges the skill expects, increasing the chance of overbroad execution in environments that honor manifest-level restrictions.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file claims each question opens a fresh browser session and closes, yet elsewhere documents persistent browser_state storage and auth/session retention. That inconsistency can mislead users about privacy and persistence boundaries, causing them to assume less residual credential/session risk than actually exists.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The documentation includes a notebook removal command without an adjacent warning that it is destructive. In an agent-driven workflow, undocumented destructive actions increase the risk of accidental data or metadata loss, especially when commands may be selected or suggested automatically from examples.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The limitations section states there is no session persistence, but the skill also documents persistent authentication data and browser session storage under the user's home directory. This contradiction creates a real security transparency problem because users may underestimate credential retention and local artifact exposure.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest describes a skill to query Google NotebookLM notebooks for source-grounded answers, but this reference advertises broader functionality: creating and deleting notebook-library entries, activating defaults, managing auth state, and cleaning stored data. Those may support the skill operationally, but documenting them as core exposed capabilities makes the skill's actual scope materially broader than a query-focused description suggests.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The notebook removal command is documented without any warning about deletion impact, default notebook changes, or whether removal affects only the local library versus remote NotebookLM content. Ambiguity around destructive actions can lead to unintended data loss or mistaken assumptions about what is being deleted.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The auth management documentation describes clearing authentication but does not clearly warn that this may delete browser session state, cookies, and persistent login artifacts. In a skill that stores browser state locally, unclear deletion semantics can cause accidental credential/session loss and unsafe operator assumptions during cleanup.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md **Options:** - `--confirm`: Actually perform cleanup - `--preserve-library`: Keep notebook library - `--force`: Skip confirmation prompt ### run.py Script wrapper that handles environment setup.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
python **Options:** - `--confirm`: Actually perform cleanup - `--preserve-library`: Keep notebook library - `--force`: Skip confirmation prompt ### run.py Script wrapper that handles environment setup.
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documentation explicitly recommends switching or using multiple Google accounts to work around daily query limits. That encourages evasion of provider-imposed controls and can facilitate abusive automation or policy violations, which is risky in a skill designed for automated access to a third-party service.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The account switching and rotation guidance includes clearing auth and using multiple accounts to bypass rate limits, which goes beyond a simple notebook-query workflow. This is risky because it normalizes evasive operational behavior and broadens the skill’s effective purpose into account management and quota circumvention.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The troubleshooting guide documents
notebook_manager.py add, which enables creation or modification of local notebook library state beyond the skill’s stated query-only purpose. This expands operator expectations and capability surface, making it easier for downstream agents or users to perform state-changing actions not clearly disclosed in the manifest.- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
python scripts/run.py [any_script].py
run.py will:
1. Create .venv if missing
2. Install dependencies
3. Run the script
text
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The instructions tell users to delete
~/.claude/skills/notebooklm/data/library.jsonas part of recovery without a prominent warning that this removes notebook library state. Even with a backup step nearby, users may run only the deletion command or miss the recovery context, causing avoidable data loss.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The complete reset procedure includes forceful cleanup and removal of
.venvwithout a clear safety banner about deleting environment state and potentially affecting local data or active processes. In troubleshooting docs, users often paste commands verbatim, so destructive recovery steps need strong guardrails.- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 85% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
python scripts/run.py notebook_manager.py list | head -5
Check data directory
ls -la ~/.claude/skills/notebooklm/data/
text ### Common questions
Static analysis
No suspicious patterns detected.