ClawHub
Back to skill

Security audit

Notebooklm

Security checks for vulnerabilities and agentic risk

Overview

This NotebookLM skill is mostly coherent, but it gives an agent too much room to upload local or Google Drive documents to an authenticated Google service without clear per-source consent.

Review before installing. Use this only if you are comfortable connecting a Google account to an unofficial NotebookLM client, and require explicit approval before adding local files, Drive documents, bulk research results, exports, sharing changes, profile switches, or global language changes. A dedicated Google account or isolated profile would reduce accidental exposure.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:61
Finding

Autonomous Upload of Local and Google Drive Documents Without Explicit User Confirmation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 61–69; supporting command examples at lines 89–92 and 127–130
Vulnerability Type: External disclosure of user-selected files without per-upload consent
Risk Level: High

Vulnerable Code Snippet

markdown
**Run without confirmation:**
- `notebooklm status`, `list`, `doctor` — read-only
- `notebooklm auth check` — diagnostics
- `notebooklm create` — create notebook
- `notebooklm use <id>` — set context (⚠️ single-agent only; use `-n` in parallel)
- `notebooklm source add` — add sources
- `notebooklm ask "..."` — chat (without `--save-as-note`)
- `notebooklm language list/get/set` — language settings
- `notebooklm profile list/create/switch` — profile management

The documented source commands include local files and Google Drive content:

bash
notebooklm source add "https://example.com/article"
notebooklm source add ./report.pdf
notebooklm source add "https://www.youtube.com/watch?v=VIDEO_ID"
notebooklm source add-drive <drive_file_id> "Doc Title"

Technical Analysis

The autonomy policy explicitly permits notebooklm source add to run without confirmation. The same documentation establishes that source addition supports local files, Google Drive documents, PDFs, audio, video, images, and other potentially sensitive content.

Adding these sources is not a local read-only operation. It transmits document content to Google NotebookLM through an unofficial client that uses undocumented Google APIs. Consequently, a broadly phrased request such as “summarize these documents” could cause an agent to select and upload a local or Drive-hosted document without presenting the exact source and external destination to the user for approval.

This violates least-privilege and informed-consent principles. Permission to access a file for a local task does not inherently grant permission to disclose it to an external service. ...[truncated 1991 chars]

Remediation
View remediation

Remediation Suggestions

  1. Move all local-file and Google Drive source additions into the “Ask user first” category.
  2. Require explicit, per-source confirmation before upload. The prompt should identify:
    • The exact local path or Drive item
    • The destination service and Google account or profile
    • That the complete content may leave the local environment
    • Whether the source may contain sensitive information
  3. Distinguish remote URLs supplied directly by the user from local or private content. Only explicitly supplied public URLs should be eligible for autonomous addition.
  4. Require a second confirmation when adding folders, multiple files, wildcard selections, batch imports, or research results that may include private Drive content.
  5. Apply source allowlists and path restrictions so the agent cannot select unrelated files, credential directories, private keys, browser profiles, or hidden configuration files.
  6. Add a dry-run step that displays the proposed notebook, source list, file sizes, and destination before any transfer.
  7. Prefer explicit notebook IDs through -n <notebook_id> and isolated profiles to prevent content from being uploaded to the wrong notebook or account.
  8. Record an audit event for every upload, including the source, destination notebook, authenticated profile, time, and user approval.
  9. Update the autonomy policy to state that access to a file for analysis does not imply authorization to upload it to an external service.
  10. Document deletion and retention procedures so users can remove mistakenly uploaded sources promptly.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The README instructs users to authenticate with a Google account but does not clearly disclose that doing so grants this unofficial tool access to NotebookLM-associated Google data and may send notebook contents, sources, prompts, and generated artifacts through undocumented Google APIs. Because this skill manages sources, exports, sharing, and content generation programmatically, the missing disclosure can mislead users about the privacy and account-access implications of setup.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill description advertises activation on very generic requests such as creating podcasts, presentations, quizzes, or summarizing documents, which are common cross-domain tasks unrelated to NotebookLM specifically. In an agent environment, this can cause overbroad routing so the skill activates unexpectedly and performs networked actions or account-scoped operations under the wrong context.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The intent-detection section lists broad, generic requests without clear exclusions, making accidental activation likely. Because this skill can create notebooks, import external sources, and interact with authenticated Google account data, ambiguous triggering increases the risk of unintended external actions and privacy-impacting operations.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
89% confidence
Finding

The autonomy rules allow the agent to run state-changing and externally connected commands without confirmation, including creating notebooks, switching active notebook context, adding sources, changing language globally, and managing profiles. Although some commands are framed as routine, they can modify account state, upload local files or remote URLs, and affect future operations, so permitting them automatically raises the risk of unintended data exposure or account changes.

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

md
## Autonomy Rules

**Run without confirmation:**
- `notebooklm status`, `list`, `doctor` — read-only
- `notebooklm auth check` — diagnostics
- `notebooklm create` — create notebook

Static analysis

No suspicious patterns detected.