ClawHub
Back to skill

Security audit

NotebookLM API

Security checks for vulnerabilities and agentic risk

Overview

This NotebookLM skill is purpose-aligned overall, but it gives the agent broad automatic authority to use a Google account, upload sources, change settings, and install/update unaudited external code.

Review this before installing. Use a dedicated virtual environment and least-privileged Google account, avoid CI secrets unless necessary, pin and verify the CLI version, and require confirmation before uploading files/URLs, creating notebooks, changing language settings, downloading files, spawning background agents, or running `notebooklm skill install`.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:13
Finding

Unpinned External Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 13–29
Vulnerability Type: Unpinned third-party dependency and externally resolved executable code
Risk Level: Medium

Vulnerable Code

bash
pip install notebooklm-py
bash
# Get the latest release tag (using curl)
LATEST_TAG=$(curl -s https://api.github.com/repos/teng-lin/notebooklm-py/releases/latest | grep '"tag_name"' | cut -d'"' -f4)
pip install "git+https://github.com/teng-lin/notebooklm-py@${LATEST_TAG}"
bash
notebooklm skill install

Technical Analysis

The installation instructions retrieve and install executable third-party code without pinning an audited package version, immutable commit hash, or artifact integrity hash.

The PyPI command resolves the package version at installation time. The GitHub alternative dynamically queries release metadata and installs whichever release is marked as the latest at that moment. A release tag is more stable than the repository's main branch, but dynamically selecting the latest tag does not ensure that the installed source is identical to the version reviewed during this audit.

The subsequent notebooklm skill install command may install additional skill content that is not included in this repository. That externally installed content was therefore outside the available audit scope.

This creates a supply-chain trust boundary in which the effective executable payload can change after review. The issue does not demonstrate that the current upstream package is malicious; it means the documented installation process lacks controls that reliably bind installation to reviewed artifacts.

Attack Path

  1. An attacker compromises an upstream maintainer account, package registry entry, source repository, release workflow, release metadata, or another dependency in the upstream package's dependency graph.
  2. The attacker publishes a malicious package release or causes a malicious release to be identified as the latest ...[truncated 1474 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin notebooklm-py to a specific version that has been reviewed:

    bash
    python -m pip install "notebooklm-py==<reviewed-version>"

  2. Use a hash-locked requirements file and require hash verification:

    bash
    python -m pip install --require-hashes -r requirements.txt

  3. If installation from GitHub is necessary, pin an immutable, reviewed commit SHA rather than dynamically resolving the latest release:

    bash
    python -m pip install \
  "git+https://github.com/teng-lin/notebooklm-py@<full-reviewed-commit-sha>"

  4. Verify package provenance, release signatures, checksums, and the upstream maintainer's release process before updating the pinned version.

  5. Lock and review transitive dependencies using a reproducible dependency-management process. Perform vulnerability and malware scanning on the resulting artifacts.

  6. Vendor the installed skill content into the reviewed project, or pin it to an immutable version and audit it separately before executing notebooklm skill install.

  7. Install and run the CLI in a dedicated virtual environment or sandbox under a least-privileged account. Restrict access to unrelated files, environment secrets, and credentials.

  8. Document an explicit update process requiring security review and hash updates instead of resolving the newest available release during installation.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (6)

YARA rule 'agent_skill_remote_bootstrap_execution': Remote script or code download followed by execution/bootstrap installation [agent_skills]

High
Category
YARA Match
Confidence
94% confidence
Finding

The installation flow includes fetching a release tag from GitHub and then executing pip install from a remote Git repository, followed by installing the skill. This is remote bootstrap execution and expands supply-chain risk because code is downloaded and executed from external infrastructure rather than from a tightly controlled, pinned, and verified artifact.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

bash
pip install notebooklm-py

From GitHub (use latest release tag, NOT main branch):

bash
# Get the latest release tag (using curl)
LATEST_TAG=$(curl -s https://api.github.com/repos/teng-lin/notebooklm-py/releases/latest | grep '"tag_name"' | cut -d'"' -f4)
pip install "git+https://github.com/teng-lin/notebooklm-py@${LATEST_TAG}"

⚠️ DO NOT install from main branch (pip install git+https://github.com/teng-lin/notebooklm-py). The main branch may contain unreleased/unstable changes. Always use PyPI or a specific release tag, unless you are testing unreleased features.

After installation, install the Claude Code skill:

bash
notebooklm skill install

Prerequisites

IMPORTANT: Before using any command, you MUST authenticate:

bash
notebooklm login          # Opens browser for Google OAuth
notebooklm list           # Verify authentication works

If commands fail with authentication errors, re-run notebooklm login.

CI/CD, Multiple A

Self-Modification

High
Category
Rogue Agent
Confidence
89% confidence
Finding

The skill instructs users to run notebooklm skill install as an update mechanism, which is a self-modification pathway for the agent environment. Allowing a skill to update or reinstall itself increases supply-chain and persistence risk, especially if done without independent trust checks, version pinning, or approval.

Content

Scanner excerpt · SKILL.md (reported line 545)May include surrounding context.

md
**Diagnose auth:** `notebooklm auth check` - shows cookie domains, storage path, validation status
**Re-authenticate:** `notebooklm login`
**Check version:** `notebooklm --version`
**Update skill:** `notebooklm skill install`

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

From GitHub (use latest release tag, NOT main branch):

bash
# Get the latest release tag (using curl)
LATEST_TAG=$(curl -s https://api.github.com/repos/teng-lin/notebooklm-py/releases/latest | grep '"tag_name"' | cut -d'"' -f4)
pip install "git+https://github.com/teng-lin/notebooklm-py@${LATEST_TAG}"

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The activation section includes broad natural-language triggers such as 'Create a podcast about [topic]' and 'Summarize these URLs/documents)' that can match ordinary user requests without an explicit request to use NotebookLM. This creates a tool-confusion risk where the agent may invoke an external service, upload content, or change state when the user only asked for a generic task.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
84% confidence
Finding

The skill explicitly authorizes autonomous execution of stateful and networked commands without confirmation, including listing notebooks, checking auth, creating notebooks, querying content, and adding sources. In this context, automatic execution increases the chance of unintended remote actions, data uploads, and account changes triggered by ambiguous prompts.

Content

Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.

md
## Autonomy Rules

**Run automatically (no confirmation):**
- `notebooklm status` - check context
- `notebooklm auth check` - diagnose auth issues
- `notebooklm list` - list notebooks

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill marks notebooklm language set as safe to run automatically even though the document later states that language is a GLOBAL setting affecting all notebooks in the account. Automatically changing an account-wide preference can silently alter future outputs and disrupt unrelated workflows.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.