NotebookLM CLI Cookies

• Outcome: Review
• Latest audit: May 28, 2026, 11:50 AM
• Version:
  0.1.4

Overview

The skill is mostly aligned with querying NotebookLM, but it needs Review because it forwards raw Telegram commands to a CLI and ships privileged VPS setup scripts that handle reusable Google session cookies.

Install only in a controlled environment where you trust both the VPS and everyone who can send `/nlm` commands. Review the bootstrap before running it with sudo, avoid broad Telegram command access, restrict use to read-only NotebookLM queries where possible, and be prepared to rotate or revoke the copied Google/NotebookLM cookies.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (23)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill declares no permissions while its instructions clearly rely on shell execution and environment access, which creates a transparency and policy-enforcement gap. In practice this can let a seemingly simple retrieval skill run commands and touch auth-related state without adequate review or user awareness.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: This script performs broad host provisioning, package installation, workspace modification, credential setup, and optional systemd reconfiguration/restart, which substantially exceeds the stated purpose of a NotebookLM document-query skill. In a skill bundle, this creates a dangerous expansion of trust: installing the skill can alter the host and service behavior, increasing the attack surface and enabling persistence-like changes if the bundle is ever tampered with.

Context-Inappropriate Capability

High

• Confidence: 94% confidence
• Finding: The script installs OS packages and globally installs tooling such as clawhub, requiring elevated privileges unrelated to answering NotebookLM queries. Embedding host-level package management in a skill materially increases risk because a user expecting a query capability may unknowingly grant root-level system modification authority.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The script writes a systemd drop-in, reloads the daemon, and restarts a service, which gives the bundle the ability to alter service startup behavior and operational state. This is especially risky in the skill context because it introduces persistence and configuration control unrelated to simple NotebookLM search/summarization functionality.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The skill instructs the agent to inspect NOTEBOOKLM_MCP_CLI_PATH and verify login state, which reveals and depends on credential storage details without warning the user that auth artifacts are being accessed. Even if it only checks presence/status, this normalizes handling sensitive auth locations and increases the chance of credential leakage through logs, debugging, or misuse by adjacent tooling.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill mandates sending user questions to the nlm CLI, which in turn queries an external NotebookLM service, but it does not clearly disclose that user-provided content will leave the local environment. This can cause inadvertent disclosure of sensitive prompts or document-derived questions when users believe the agent is answering locally.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The helper script reads the NotebookLM auth JSON and writes derived credential files into a profile directory, handling sensitive session material. Although it sets restrictive permissions later, the bundle does not provide a strong security warning, lifecycle guidance, or minimization of secret exposure, which raises the chance of credential mishandling in operational use.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The script restarts the specified service immediately after writing the systemd drop-in, without an interactive confirmation or a final explicit warning. In an administrative script this can cause unintended downtime or activate a modified service configuration before the operator has reviewed the changes.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

fi
}

require_sudo

echo "[1/7] Installing OS packages (jq, pipx, python tooling)..."
sudo apt-get update -y

• Confidence: 90% confidence
• Finding: sudo

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

require_sudo

echo "[1/7] Installing OS packages (jq, pipx, python tooling)..."
sudo apt-get update -y
sudo apt-get install -y jq python3-pip python3-venv pipx

echo "[2/7] Installing notebooklm-mcp-cli (nlm)..."

• Confidence: 90% confidence
• Finding: sudo

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

echo "[3/7] Installing ClawHub CLI (clawhub) if missing..."
if ! command -v clawhub >/dev/null 2>&1; then
  if command -v npm >/dev/null 2>&1; then
    sudo npm i -g clawhub
  elif command -v pnpm >/dev/null 2>&1; then
    sudo pnpm add -g clawhub
  else

• Confidence: 90% confidence
• Finding: sudo

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

if command -v npm >/dev/null 2>&1; then
    sudo npm i -g clawhub
  elif command -v pnpm >/dev/null 2>&1; then
    sudo pnpm add -g clawhub
  else
    echo "Error: clawhub is missing and neither npm nor pnpm is available." >&2
    echo "Install one of them, then run: npm i -g clawhub  (or pnpm add -g clawhub)" >&2

• Confidence: 89% confidence
• Finding: sudo

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

echo "OK: injected NotebookLM auth into ${PROFILE_DIR}"
EOF

sudo mv /tmp/notebooklm-auth-inject.sh "${INJECT_BIN}"
sudo chown "${TARGET_USER}":"${TARGET_USER}" "${INJECT_BIN}"
sudo chmod 0755 "${INJECT_BIN}"

• Confidence: 84% confidence
• Finding: sudo

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

echo "[7/7] Setting up systemd integration (optional)..."

sudo mkdir -p /etc/openclaw
sudo touch "${AUTH_FILE}"
sudo chown root:root "${AUTH_FILE}"

• Confidence: 88% confidence
• Finding: sudo

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

echo "[7/7] Setting up systemd integration (optional)..."

sudo mkdir -p /etc/openclaw
sudo touch "${AUTH_FILE}"
sudo chown root:root "${AUTH_FILE}"

if ! getent group openclaw >/dev/null 2>&1; then

• Confidence: 85% confidence
• Finding: sudo

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

sudo mkdir -p /etc/openclaw
sudo touch "${AUTH_FILE}"
sudo chown root:root "${AUTH_FILE}"

if ! getent group openclaw >/dev/null 2>&1; then
  sudo groupadd openclaw

• Confidence: 83% confidence
• Finding: sudo

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

sudo chown root:root "${AUTH_FILE}"

if ! getent group openclaw >/dev/null 2>&1; then
  sudo groupadd openclaw
fi
sudo usermod -aG openclaw "${TARGET_USER}" || true
sudo chgrp openclaw "${AUTH_FILE}"

• Confidence: 84% confidence
• Finding: sudo

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

fi
sudo usermod -aG openclaw "${TARGET_USER}" || true
sudo chgrp openclaw "${AUTH_FILE}"
sudo chmod 0640 "${AUTH_FILE}"

if [[ -n "${OPENCLOW_SERVICE}" ]]; then
  sudo mkdir -p "/etc/systemd/system/${OPENCLOW_SERVICE}.d"

• Confidence: 91% confidence
• Finding: sudo

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

Environment=NOTEBOOKLM_AUTH_FILE=${AUTH_FILE}
ExecStartPre=${INJECT_BIN}
EOF
  sudo mv "/tmp/notebooklm-dropin.conf" "/etc/systemd/system/${OPENCLOW_SERVICE}.d/notebooklm.conf"
  sudo systemctl daemon-reload
  echo "Installed systemd drop-in: /etc/systemd/system/${OPENCLOW_SERVICE}.d/notebooklm.conf"
  echo "Restarting service: ${OPENCLOW_SERVICE}"

• Confidence: 90% confidence
• Finding: sudo

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

ExecStartPre=${INJECT_BIN}
EOF
  sudo mv "/tmp/notebooklm-dropin.conf" "/etc/systemd/system/${OPENCLOW_SERVICE}.d/notebooklm.conf"
  sudo systemctl daemon-reload
  echo "Installed systemd drop-in: /etc/systemd/system/${OPENCLOW_SERVICE}.d/notebooklm.conf"
  echo "Restarting service: ${OPENCLOW_SERVICE}"
  sudo systemctl restart "${OPENCLOW_SERVICE}" || true

• Confidence: 89% confidence
• Finding: sudo

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

sudo systemctl daemon-reload
  echo "Installed systemd drop-in: /etc/systemd/system/${OPENCLOW_SERVICE}.d/notebooklm.conf"
  echo "Restarting service: ${OPENCLOW_SERVICE}"
  sudo systemctl restart "${OPENCLOW_SERVICE}" || true
else
  echo "No --service provided. Skipping systemd drop-in."
fi

• Confidence: 90% confidence
• Finding: sudo

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

fi
sudo usermod -aG openclaw "${TARGET_USER}" || true
sudo chgrp openclaw "${AUTH_FILE}"
sudo chmod 0640 "${AUTH_FILE}"

if [[ -n "${OPENCLOW_SERVICE}" ]]; then
  sudo mkdir -p "/etc/systemd/system/${OPENCLOW_SERVICE}.d"

• Confidence: 91% confidence
• Finding: chmod 0640

Session Persistence

Medium

• Category: Rogue Agent

Content

- metadata.json
```

Create one JSON file named `notebooklm-auth.json`:

```json
{

• Confidence: 93% confidence
• Finding: Create one JSON file named `notebooklm-auth.json`: ```json { "cookies": <contents of cookies.json>, "metadata": <contents of metadata.json> } ``` ## 5) Copy auth to the VPS (required) On the VP

VirusTotal

59/59 vendors flagged this skill as clean.