T09 · Insecure Skill Coding Practices
Error
- Location
scripts/bootstrap_vps_systemd_one_liner.sh:94- Finding
Command Injection Through Untrusted Bootstrap Arguments
- Content
View full analysis
- Remediation
View remediation
Security audit
NotebookLM CLI Cookies
Security checks for vulnerabilities and agentic risk
Overview
This skill can do the advertised NotebookLM querying, but its bundled setup scripts handle Google session cookies and make privileged VPS/systemd changes with unsafe command boundaries.
Review before installing on any real VPS. Use a dedicated low-privilege Google account/profile, protect and rotate NotebookLM cookies, avoid exposing /nlm to untrusted Telegram users, and do not run the bootstrap as root unless you accept its package installs, /etc changes, group changes, OpenClaw config edits, and optional systemd hook. Prefer a manually reviewed, pinned, least-privilege setup if possible.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/bootstrap_vps_systemd_one_liner.sh:159- Finding
Predictable Temporary Files Used During Privileged Installation
- Content
View full analysis
/tmp/notebooklm-auth-inject.sh <<'EOF' #!/usr/bin/env bash set -euo pipefail if ! command -v jq >/dev/null 2>&1; then echo "Error: jq is required but not installed." >&2 exit 1 fi AUTH_FILE="${NOTEBOOKLM_AUTH_FILE:-/etc/openclaw/notebooklm-auth.json}" NOTEBOOKLM_MCP_CLI_PATH="${NOTEBOOKLM_MCP_CLI_PATH:-}" ``` It later installs that file: ```bash sudo mv /tmp/notebooklm-auth-inject.sh "${INJECT_BIN}" sudo chown "${TARGET_USER}":"${TARGET_USER}" "${INJECT_BIN}" sudo chmod 0755 "${INJECT_BIN}" ``` A systemd drop-in is also created through another predictable shared path: ```bash cat > "/tmp/notebooklm-dropin.conf" < file` follows symbolic links and can therefore truncate or overwrite another file with the bootstrap's privileges. There is also a time-of-check/time-of-use window between generating the file and moving it to its final destination. A local attacker may attempt to replace the temporary object before `sudo mv` installs it. The helpe ...[truncated 1553 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
scripts/bootstrap_vps_systemd_one_liner.sh:107- Finding
Unpinned Third-Party Packages Installed With Elevated Privileges
- Content
View full analysis
/dev/null 2>&1"; then as_user "pipx install notebooklm-mcp-cli >/dev/null 2>&1 || pipx upgrade notebooklm-mcp-cli >/dev/null 2>&1 || true" as_user "pipx ensurepath >/dev/null 2>&1 || true" fi if ! as_user "command -v nlm >/dev/null 2>&1"; then # Fallback for environments where pipx is unavailable/misconfigured. as_user "python3 -m pip install --user --upgrade --break-system-packages notebooklm-mcp-cli" fi ``` ClawHub is globally installed through npm or pnpm with `sudo`: ```bash if ! command -v clawhub >/dev/null 2>&1; then if command -v npm >/dev/null 2>&1; then sudo npm i -g clawhub elif command -v pnpm >/dev/null 2>&1; then sudo pnpm add -g clawhub else echo "Error: clawhub is missing and neither npm nor pnpm is available." >&2 echo "Install one of them, then run: npm i -g clawhub (or pnpm add -g clawhub)" >&2 exit 1 fi fi ``` ### Technical Analysis The Python and JavaScript package commands do not specify reviewed versions, package hashes, or a lockfile. The `upgrade` options expressly allow newly published versions to replace previously installed code without another review. Package installation can execute package-controlled build steps, setup code, or lifecycle scripts. The global npm and pnpm commands are run through `sudo`, so package lifecycle behavior may execute with root privileges depending on package-manager configuration. No evidence was found that the named packages ar ...[truncated 1527 chars]- Remediation
View remediation
` and `clawhub@`. - Use hash verification for Python artifacts and lock transitive dependencies where supported. - Record package checksums or signatures and verify them before installation. - Avoid running npm or pnpm package lifecycle scripts as root. Install the CLI under a dedicated, unprivileged service account or use a verified prebuilt artifact. - Consider disabling lifecycle scripts during installation when they are not required. - Replace `--upgrade` behavior with an explicit, administrator-approved update process. - Pin operating-system package versions where reproducible deployment is required and use only authenticated repository metadata. - Document the expected package publishers and periodically review dependency ownership, release history, and advisories. ]]>
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:30- Finding
Raw Telegram Input Forwarded to the Exec Tool as CLI Arguments
- Content
View full analysis
` via Exec, and return the relevant stdout. ``` ### Technical Analysis The Skill explicitly instructs the Agent to treat all raw text following `/nlm` as command-line arguments and submit it to the Exec tool. It does not define an argument parser, an allowlist of permitted subcommands, or a requirement to use a non-shell argument-vector interface. If the Exec implementation constructs a shell command such as `nlm `, shell metacharacters, substitutions, redirections, or command separators in the Telegram message can be interpreted by the shell. Even where the execution framework performs some quoting, relying on implicit Agent behavior rather than an explicit parsing and validation policy creates an unsafe command boundary. This finding does not assert that the `nlm` executable itself interprets shell syntax. Exploitation depends on whether the surrounding Exec implementation invokes a shell or serializes the raw text into a shell command. ### Attack Path 1. A user with access to the Telegram bot submits a `/nlm` request containing shell syntax rather than ordinary NotebookLM arguments. 2. The Skill directs the Agent to preserve the raw text and construct `nlm `. 3. The Agent sends that command to a shell-capable Exec implementation. 4. The shell interprets the malicious separators, substitutions, or redirections. 5. Commands outside the intended `nlm` operation execute under the OpenClaw service account. If the Exec tool uses a direct argument vector and never invokes a shell, shell metacharacter injection ...[truncated 775 chars]- Remediation
View remediation
` - Validate aliases and notebook identifiers against strict formats. - Treat the question as one opaque argument rather than executable syntax. - Reject unsupported options, control characters, redirections, command substitutions, and shell separators. - Apply Telegram authorization controls so only approved users can invoke administrative or state-changing `nlm` operations. - Separate read-only query functionality from alias creation or other state-changing CLI commands. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- Rogue AgentSelf-Modification, Session Persistence
Findings (54)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description says this skill is for searching and answering questions over existing NotebookLM documents via the nlm CLI. The supplied code does not perform any search, summarization, notebook querying, or document interaction at all. Instead, its primary function is credential injection/setup: it obtains a secret payload containing cookies/metadata, optionally calls AWS Secrets Manager, and writes authentication files into a NotebookLM profile directory with restrictive permissions. This is a materially different purpose and includes undeclared secret-access and auth-file-writing capabilities, so the description does not accurately represent the code.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description presents a document-querying/search skill for NotebookLM, but the supplied code chunk is not performing search, summarization, or answering over uploaded documents. Instead, it is an infrastructure/bootstrap script for Linux VPS deployment and service integration. Its primary behavior is system administration: package installation, CLI installation, workspace setup, auth cookie injection, config mutation, permission management, group membership changes, and optional systemd integration/restart. These are materially different capabilities and resource accesses from the declared purpose, and none of them are reflected in the declared permissions. This is a clear description-behavior mismatch.
- Content
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
Trong NotebookLM notebook alias tai_lieu_dien: trả lời câu hỏi "giá của A9N61500 là bao nhiêu?". Bắt buộc dùng nlm để truy vấn, không tìm web, không đọc file local.
text ## Output Guidelines - Be explicit about notebook identity (title + id when available). - If query result is empty or vague, suggest a refined follow-up query.
YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]
High
- Category
- YARA Match
- Confidence
- 88% confidence
- Finding
The document explicitly directs the operator to extract Google cookies from a browser profile and move them to another machine for automated use. Even though framed as setup instructions, this mirrors credential-harvesting and session-transfer behavior and can enable unauthorized account access if reused, stolen, or applied outside the intended environment.
- Content
service start (if you pass
--service)Compatibility notes:
- The bootstrap avoids
apt install npmto preventnodejs/npmconflict on NodeSource-based systems. - On PEP 668 systems (
externally-managed-environment), it usespipxfirst and only falls back topip --break-system-packagesif required.
4) Prepare NotebookLM auth (on a machine with a browser)
NotebookLM requires Google cookies. You must prepare auth on a machine with Chrome:
bash nlm loginThe default profile is stored at:
text ~/.notebooklm-mcp-cli/profiles/default/ - cookies.json - metadata.jsonCreate one JSON file named
notebooklm-auth.json:json { "cookies": <contents of cookies.json>, "metadata": <contents of metadata.json> }5) Copy auth to the VPS (required)
On the VPS, store the file at:
text /etc/openclaw/notebooklm-auth.jsonSet permissions (recommended):
bash sudo mkdir -p /etc/openclaw sudo cp ./notebooklm-auth.json /etc/openclaw/notebooklm-a- The bootstrap avoids
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script requires sudo/root and exercises privileged system administration capabilities that exceed what is justified for querying NotebookLM documents. Because it can install software, modify groups and file permissions, and inject an ExecStartPre hook into a service, any mistake, dependency compromise, or parameter abuse can affect the whole host rather than only the skill's user environment.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This bootstrap script performs broad privileged actions unrelated to a narrow document-query skill: installing OS packages, globally installing tools, modifying user config, creating groups, writing to /etc, and altering systemd service behavior. In the context of an agent skill, this materially expands the trust boundary and persistence surface, so a compromised or swapped package/slug could lead to full host compromise or lasting service manipulation.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill declares no explicit tool scope or allowed-tools restrictions even though its instructions clearly require shell execution and environment access. In practice this gives the runtime broader discretion than necessary, increasing the blast radius if the skill is misused, modified, or prompt-injected into running unintended commands.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 84% confidence
- Finding
The guide instructs users to consolidate browser-derived cookies and metadata into a reusable JSON credential file and persist it on a VPS. That creates a long-lived bearer secret that can grant access to a Google/NotebookLM session if the file, backups, logs, or the host are compromised.
- Content
- metadata.json
text Create one JSON file named `notebooklm-auth.json`: ```json {
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Set permissions (recommended):
bash sudo mkdir -p /etc/openclaw sudo cp ./notebooklm-auth.json /etc/openclaw/notebooklm-auth.json sudo chown root:openclaw /etc/openclaw/notebooklm-auth.json sudo chmod 640 /etc/openclaw/notebooklm-auth.json
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Set permissions (recommended):
bash sudo mkdir -p /etc/openclaw sudo cp ./notebooklm-auth.json /etc/openclaw/notebooklm-auth.json sudo chown root:openclaw /etc/openclaw/notebooklm-auth.json sudo chmod 640 /etc/openclaw/notebooklm-auth.json
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Set permissions (recommended):
bash sudo mkdir -p /etc/openclaw sudo cp ./notebooklm-auth.json /etc/openclaw/notebooklm-auth.json sudo chown root:openclaw /etc/openclaw/notebooklm-auth.json sudo chmod 640 /etc/openclaw/notebooklm-auth.json
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Set permissions (recommended):
bash sudo mkdir -p /etc/openclaw sudo cp ./notebooklm-auth.json /etc/openclaw/notebooklm-auth.json sudo chown root:openclaw /etc/openclaw/notebooklm-auth.json sudo chmod 640 /etc/openclaw/notebooklm-auth.json
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Set permissions (recommended):
bash sudo mkdir -p /etc/openclaw sudo cp ./notebooklm-auth.json /etc/openclaw/notebooklm-auth.json sudo chown root:openclaw /etc/openclaw/notebooklm-auth.json sudo chmod 640 /etc/openclaw/notebooklm-auth.json
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
sudo mkdir -p /etc/openclaw sudo cp ./notebooklm-auth.json /etc/openclaw/notebooklm-auth.json sudo chown root:openclaw /etc/openclaw/notebooklm-auth.json sudo chmod 640 /etc/openclaw/notebooklm-auth.json
text Then restart your OpenClaw service:
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This script provisions and persists live authentication material to disk, which is a privileged capability beyond the skill's stated document-query purpose. Even if intended for headless setup, embedding credential injection logic inside the skill increases the attack surface and creates a path for secret handling, misuse, or accidental exposure in environments that only expected read/query behavior.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The script reads sensitive cookies and metadata from files, environment variables, or AWS Secrets Manager and writes them to local files without any user-facing warning, consent flow, or audit controls. In this skill context, silently materializing session credentials is risky because these cookies may grant account access and could be exposed through misconfiguration, backups, or later filesystem access.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The script can fetch secrets directly from AWS Secrets Manager, granting the skill an external secret-retrieval capability not implied by its query-oriented description. In a skill context, this broadens trust boundaries: anyone able to trigger this setup path in a privileged environment may cause sensitive auth data to be materialized locally.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
sh > "${METADATA_FILE}" fi chmod 700 "${NOTEBOOKLM_MCP_CLI_PATH}" "${NOTEBOOKLM_MCP_CLI_PATH}/profiles" "${PROFILE_DIR}" || true chmod 600 "${COOKIES_FILE}" "${METADATA_FILE}" || true echo "NotebookLM auth injected to: ${PROFILE_DIR}"
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
sh > "${METADATA_FILE}" fi chmod 700 "${NOTEBOOKLM_MCP_CLI_PATH}" "${NOTEBOOKLM_MCP_CLI_PATH}/profiles" "${PROFILE_DIR}" || true chmod 600 "${COOKIES_FILE}" "${METADATA_FILE}" || true echo "NotebookLM auth injected to: ${PROFILE_DIR}"
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
sh fi chmod 700 "${NOTEBOOKLM_MCP_CLI_PATH}" "${NOTEBOOKLM_MCP_CLI_PATH}/profiles" "${PROFILE_DIR}" || true chmod 600 "${COOKIES_FILE}" "${METADATA_FILE}" || true echo "NotebookLM auth injected to: ${PROFILE_DIR}" echo "Set NOTEBOOKLM_MCP_CLI_PATH=${NOTEBOOKLM_MCP_CLI_PATH} for OpenClaw runtime."
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
sh fi chmod 700 "${NOTEBOOKLM_MCP_CLI_PATH}" "${NOTEBOOKLM_MCP_CLI_PATH}/profiles" "${PROFILE_DIR}" || true chmod 600 "${COOKIES_FILE}" "${METADATA_FILE}" || true echo "NotebookLM auth injected to: ${PROFILE_DIR}" echo "Set NOTEBOOKLM_MCP_CLI_PATH=${NOTEBOOKLM_MCP_CLI_PATH} for OpenClaw runtime."
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The comment claims the script does not obtain cookies, but the implemented behavior goes further than simple setup by reading
${AUTH_FILE}and writing.cookiesand.metadatainto the NotebookLM CLI profile for operational use. While it does not fetch cookies from Google itself, the comment understates that the script actively handles and deploys authentication material.- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
sh require_sudo() { if [[ "$(id -u)" -ne 0 ]]; then if ! command -v sudo >/dev/null 2>&1; then echo "Error: sudo is required (run as root or install sudo)." >&2 exit 1 fi
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
sh require_sudo() { if [[ "$(id -u)" -ne 0 ]]; then if ! command -v sudo >/dev/null 2>&1; then echo "Error: sudo is required (run as root or install sudo)." >&2 exit 1 fi
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
sh require_sudo() { if [[ "$(id -u)" -ne 0 ]]; then if ! command -v sudo >/dev/null 2>&1; then echo "Error: sudo is required (run as root or install sudo)." >&2 exit 1 fi
Static analysis
No suspicious patterns detected.