ClawHub
Back to skill

Security audit

Notebooklm Skill Factory

Security checks for vulnerabilities and agentic risk

Overview

This skill openly builds and installs new agent skills, but it saves AI-generated instructions from external sources persistently with too little review or containment.

Install only if you want an automated skill factory that uses NotebookLM and writes new skills into your local agent skills directory. Use trusted sources, avoid private documents unless you are comfortable sending them through NotebookLM, review the full generated SKILL.md before installation, and require a fresh review before every overwrite or test run.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
references/skill-extraction-prompt.md:8
Finding

Untrusted source instructions can become a persistently installed and executed Skill

Content
View full analysis
/ directory - No placeholder text, no TODO items, no "[add content here]" - Every instruction must be actionable - Description field must clearly state both capabilities AND trigger conditions - If the sources contain specific workflows, code patterns, or APIs, include them precisely - DO NOT add any explanation before or after the code block - just the code block ``` `scripts/parse-skill-output.py:8-35`: ```python def extract_skill_content(answer: str) -> str: """Extract SKILL.md markdown from a notebooklm answ ...[truncated 6474 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The declared description presents a broad automation pipeline for generating Claude Code skills from various sources and validating them. The supplied code chunk does not implement that pipeline behavior. Instead, it only parses a JSON response, searches for markdown/code blocks or YAML frontmatter, and outputs extracted content. This is a supporting parser utility, not the full described skill behavior. Therefore the code chunk's actual behavior is materially narrower and different from the declared primary purpose.

Content

No source excerpt is available for this finding.

Self-Modification

High
Category
Rogue Agent
Confidence
96% confidence
Finding

The skill explicitly instructs iterative rewriting and overwriting of SKILL.md based on model output from NotebookLM. This is self-modification of persistent agent behavior using content derived from external sources, which creates a prompt-injection and persistence risk: malicious instructions embedded in source materials could be transformed into installed or updated skill logic.

Content

Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.

bash
     notebooklm ask "The SKILL.md generated earlier has this issue: {failure}. Based on the sources, rewrite it to fix this. Output complete corrected SKILL.md in a markdown code block." -n <id> --json
     ```
   - Parse again and overwrite SKILL.md
   - Re-test

4. **Repeat** until the skill passes a real usage test.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 34)May include surrounding context.

Usage

text
/create a skill for high-conversion landing page copywriting

The skill will:

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

该示例将技能调用方式固定为中文“/帮我做一个…的 skill”，文件中未提供英文或多语言等价触发方式，也未说明这是面向特定中文区域/语言用户的限定版本。根据语言/locale 政策，强制单一语言而无用户选择可构成自然语言策略违规。

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger phrases are broad enough that normal requests like 'create a skill' or 'make me a skill' could invoke this workflow unexpectedly. Because the workflow performs multi-step external actions, broad triggering increases the chance of unintentional execution of filesystem writes and external tool usage.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill directs the agent to create directories and write SKILL.md into ~/.claude/skills without an upfront explicit warning or confirmation before modifying the user's filesystem. In a skill that auto-generates content from external sources, silent installation is risky because untrusted or low-quality output could become persistent local agent behavior.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
91% confidence
Finding

The workflow persists generated content into ~/.claude/skills, making its effects survive the current session. Persistence increases risk because any unsafe instructions introduced during generation or validation may continue to influence future agent behavior beyond the original task.

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

Phase 3: Install & Validate

  1. Create the skill directory:
    bash
    mkdir -p ~/.claude/skills/{skill-name}

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.

  1. Create the skill directory:

    bash
    mkdir -p ~/.claude/skills/{skill-name}

  2. Write the SKILL.md:

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.

md
- One notebook per skill, one theme per notebook
- 3-10 high-quality sources work better than 20+ mixed ones
- Official docs > blog posts > YouTube transcripts
- If the skill covers multiple unrelated domains, create separate notebooks for each
- After generation, user should be the final human reviewer — check tone, logic, completeness

## Completing the Pipeline

Static analysis

No suspicious patterns detected.