NotebookLM CLI Cookies

• Outcome: Review
• Latest audit: May 28, 2026 · 11:50 AM UTC
• Version: 0.1.4

Overview

The skill is mostly aligned with querying NotebookLM, but it needs Review because it forwards raw Telegram commands to a CLI and ships privileged VPS setup scripts that handle reusable Google session cookies.

Install only in a controlled environment where you trust both the VPS and everyone who can send `/nlm` commands. Review the bootstrap before running it with sudo, avoid broad Telegram command access, restrict use to read-only NotebookLM queries where possible, and be prepared to rotate or revoke the copied Google/NotebookLM cookies.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (23)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill declares no permissions while its instructions clearly rely on shell execution and environment access, which creates a transparency and policy-enforcement gap. In practice this can let a seemingly simple retrieval skill run commands and touch auth-related state without adequate review or user awareness.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: This script performs broad host provisioning, package installation, workspace modification, credential setup, and optional systemd reconfiguration/restart, which substantially exceeds the stated purpose of a NotebookLM document-query skill. In a skill bundle, this creates a dangerous expansion of trust: installing the skill can alter the host and service behavior, increasing the attack surface and enabling persistence-like changes if the bundle is ever tampered with.

Context-Inappropriate Capability

High

• Confidence: 94% confidence
• Finding: The script installs OS packages and globally installs tooling such as clawhub, requiring elevated privileges unrelated to answering NotebookLM queries. Embedding host-level package management in a skill materially increases risk because a user expecting a query capability may unknowingly grant root-level system modification authority.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The script writes a systemd drop-in, reloads the daemon, and restarts a service, which gives the bundle the ability to alter service startup behavior and operational state. This is especially risky in the skill context because it introduces persistence and configuration control unrelated to simple NotebookLM search/summarization functionality.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The skill instructs the agent to inspect NOTEBOOKLM_MCP_CLI_PATH and verify login state, which reveals and depends on credential storage details without warning the user that auth artifacts are being accessed. Even if it only checks presence/status, this normalizes handling sensitive auth locations and increases the chance of credential leakage through logs, debugging, or misuse by adjacent tooling.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill mandates sending user questions to the nlm CLI, which in turn queries an external NotebookLM service, but it does not clearly disclose that user-provided content will leave the local environment. This can cause inadvertent disclosure of sensitive prompts or document-derived questions when users believe the agent is answering locally.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The helper script reads the NotebookLM auth JSON and writes derived credential files into a profile directory, handling sensitive session material. Although it sets restrictive permissions later, the bundle does not provide a strong security warning, lifecycle guidance, or minimization of secret exposure, which raises the chance of credential mishandling in operational use.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The script restarts the specified service immediately after writing the systemd drop-in, without an interactive confirmation or a final explicit warning. In an administrative script this can cause unintended downtime or activate a modified service configuration before the operator has reviewed the changes.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

fi
}

require_sudo

echo "[1/7] Installing OS packages (jq, pipx, python tooling)..."
sudo apt-get update -y

• Confidence: 90% confidence
• Finding: This line begins root-level package management operations, which are powerful host modifications not justified by a query skill’s normal runtime needs. In this context, requiring and using elevated privileges materially increases the danger because compromise or misuse of the bundle would affect the entire system.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

require_sudo

echo "[1/7] Installing OS packages (jq, pipx, python tooling)..."
sudo apt-get update -y
sudo apt-get install -y jq python3-pip python3-venv pipx

echo "[2/7] Installing notebooklm-mcp-cli (nlm)..."

• Confidence: 90% confidence
• Finding: The apt-get install invocation performs system-wide package installation with root privileges. While common in bootstrap scripts, inside a skill bundle this is excessive and broadens the trust boundary far beyond the advertised functionality.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

echo "[3/7] Installing ClawHub CLI (clawhub) if missing..."
if ! command -v clawhub >/dev/null 2>&1; then
  if command -v npm >/dev/null 2>&1; then
    sudo npm i -g clawhub
  elif command -v pnpm >/dev/null 2>&1; then
    sudo pnpm add -g clawhub
  else

• Confidence: 90% confidence
• Finding: Running npm globally with sudo installs software system-wide and can execute package lifecycle scripts with elevated privileges. Within a skill bundle, this creates unnecessary supply-chain and host-modification risk unrelated to normal NotebookLM query operations.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

if command -v npm >/dev/null 2>&1; then
    sudo npm i -g clawhub
  elif command -v pnpm >/dev/null 2>&1; then
    sudo pnpm add -g clawhub
  else
    echo "Error: clawhub is missing and neither npm nor pnpm is available." >&2
    echo "Install one of them, then run: npm i -g clawhub  (or pnpm add -g clawhub)" >&2

• Confidence: 89% confidence
• Finding: This pnpm global install path has the same risk profile as the npm path: privileged, system-wide modification and potential execution of package install hooks. In the context of a skill bundle, it expands capabilities in a way that is not necessary for the declared function.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

echo "OK: injected NotebookLM auth into ${PROFILE_DIR}"
EOF

sudo mv /tmp/notebooklm-auth-inject.sh "${INJECT_BIN}"
sudo chown "${TARGET_USER}":"${TARGET_USER}" "${INJECT_BIN}"
sudo chmod 0755 "${INJECT_BIN}"

• Confidence: 84% confidence
• Finding: Moving a generated script from /tmp into a user bin directory as root introduces some file-handling risk and contributes to the overall privileged modification pattern. Although the content is generated in the same script, using predictable temporary file paths in /tmp is weaker than secure temporary file creation.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

echo "[7/7] Setting up systemd integration (optional)..."

sudo mkdir -p /etc/openclaw
sudo touch "${AUTH_FILE}"
sudo chown root:root "${AUTH_FILE}"

• Confidence: 88% confidence
• Finding: Creating /etc/openclaw with sudo is another host-level privileged change outside the expected scope of a document-query skill. In context, it contributes to a pattern of system-wide configuration changes that increase operator risk and trust requirements.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

echo "[7/7] Setting up systemd integration (optional)..."

sudo mkdir -p /etc/openclaw
sudo touch "${AUTH_FILE}"
sudo chown root:root "${AUTH_FILE}"

if ! getent group openclaw >/dev/null 2>&1; then

• Confidence: 85% confidence
• Finding: Creating and owning the auth file as root establishes sensitive host-side credential storage. While not inherently malicious, doing this from a skill bundle expands the scope into credential and system administration territory, which is riskier than the advertised capability suggests.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

sudo mkdir -p /etc/openclaw
sudo touch "${AUTH_FILE}"
sudo chown root:root "${AUTH_FILE}"

if ! getent group openclaw >/dev/null 2>&1; then
  sudo groupadd openclaw

• Confidence: 83% confidence
• Finding: Creating a system group from the script modifies account policy on the host and is not necessary for simple query functionality. In the skill context, this is a privileged persistence/administration action that increases blast radius if the bundle is misused.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

sudo chown root:root "${AUTH_FILE}"

if ! getent group openclaw >/dev/null 2>&1; then
  sudo groupadd openclaw
fi
sudo usermod -aG openclaw "${TARGET_USER}" || true
sudo chgrp openclaw "${AUTH_FILE}"

• Confidence: 84% confidence
• Finding: Adding the target user to the openclaw group changes access rights on the host and can broaden access to shared sensitive resources. This is a system-level privilege adjustment that is risky and outside the narrow purpose of a NotebookLM query skill.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

fi
sudo usermod -aG openclaw "${TARGET_USER}" || true
sudo chgrp openclaw "${AUTH_FILE}"
sudo chmod 0640 "${AUTH_FILE}"

if [[ -n "${OPENCLOW_SERVICE}" ]]; then
  sudo mkdir -p "/etc/systemd/system/${OPENCLOW_SERVICE}.d"

• Confidence: 91% confidence
• Finding: Creating a systemd drop-in directory for an arbitrary service enables the script to alter service behavior at boot/runtime. In a skill bundle, that capability is disproportionately powerful and could be abused to establish persistence or interfere with service operation.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

Environment=NOTEBOOKLM_AUTH_FILE=${AUTH_FILE}
ExecStartPre=${INJECT_BIN}
EOF
  sudo mv "/tmp/notebooklm-dropin.conf" "/etc/systemd/system/${OPENCLOW_SERVICE}.d/notebooklm.conf"
  sudo systemctl daemon-reload
  echo "Installed systemd drop-in: /etc/systemd/system/${OPENCLOW_SERVICE}.d/notebooklm.conf"
  echo "Restarting service: ${OPENCLOW_SERVICE}"

• Confidence: 90% confidence
• Finding: Moving the generated drop-in into /etc/systemd/system as root applies a persistent service configuration change. This is a significant host-level action unrelated to ordinary skill execution and raises persistence and operational integrity concerns.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

ExecStartPre=${INJECT_BIN}
EOF
  sudo mv "/tmp/notebooklm-dropin.conf" "/etc/systemd/system/${OPENCLOW_SERVICE}.d/notebooklm.conf"
  sudo systemctl daemon-reload
  echo "Installed systemd drop-in: /etc/systemd/system/${OPENCLOW_SERVICE}.d/notebooklm.conf"
  echo "Restarting service: ${OPENCLOW_SERVICE}"
  sudo systemctl restart "${OPENCLOW_SERVICE}" || true

• Confidence: 89% confidence
• Finding: Reloading the systemd daemon activates recognition of the new service override, making the configuration change effective system-wide. In context, this is another privileged service-management action that exceeds the expected boundaries of a NotebookLM search skill.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

sudo systemctl daemon-reload
  echo "Installed systemd drop-in: /etc/systemd/system/${OPENCLOW_SERVICE}.d/notebooklm.conf"
  echo "Restarting service: ${OPENCLOW_SERVICE}"
  sudo systemctl restart "${OPENCLOW_SERVICE}" || true
else
  echo "No --service provided. Skipping systemd drop-in."
fi

• Confidence: 90% confidence
• Finding: Restarting the specified service as root can cause downtime and immediately applies modified startup behavior, including the injected ExecStartPre helper. This is risky in the skill context because it gives the bundle direct control over host service operation beyond its declared purpose.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

fi
sudo usermod -aG openclaw "${TARGET_USER}" || true
sudo chgrp openclaw "${AUTH_FILE}"
sudo chmod 0640 "${AUTH_FILE}"

if [[ -n "${OPENCLOW_SERVICE}" ]]; then
  sudo mkdir -p "/etc/systemd/system/${OPENCLOW_SERVICE}.d"

• Confidence: 91% confidence
• Finding: Creating a systemd drop-in directory for an arbitrary service enables the script to alter service behavior at boot/runtime. In a skill bundle, that capability is disproportionately powerful and could be abused to establish persistence or interfere with service operation.

Session Persistence

Medium

• Category: Rogue Agent

Content

- metadata.json
```

Create one JSON file named `notebooklm-auth.json`:

```json
{

• Confidence: 93% confidence
• Finding: The guide instructs users to consolidate persistent Google authentication material (cookies and metadata) into a single file and copy it onto a remote VPS for automated use. Even though it warns not to share the file, this creates long-lived session persistence on a server, increasing the blast radius if the VPS, service account, filesystem permissions, backups, or logs are compromised.

VirusTotal

59/59 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.