ClawHub
Back to skill

Security audit

nlm

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward NotebookLM CLI helper skill, but users should be careful with public sharing, collaborator invites, and installing the unpinned third-party CLI package.

Before installing, confirm you trust the notebooklm-mcp-cli package source. Before running share or invite commands, review notebook contents and recipients because sources, notes, and generated outputs may become visible outside your account. Treat MCP setup and skill update commands as persistent configuration changes.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:5
Finding
Unpinned Third-Party CLI Dependency Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 5–13 **Vulnerability Type**: Unpinned third-party package dependency **Risk Level**: Medium ### Vulnerable Code ```yaml metadata: {"clawdbot":{"emoji":"📓","requires":{"bins":["nlm"]},"install":[{"id":"uv","kind":"uv-tool","package":"notebooklm-mcp-cli","bins":["nlm","notebooklm-mcp"],"label":"Install notebooklm-mcp-cli (uv)"},{"id":"pipx","kind":"pipx","package":"notebooklm-mcp-cli","bins":["nlm","notebooklm-mcp"],"label":"Install notebooklm-mcp-cli (pipx)"},{"id":"pip","kind":"pip","package":"notebooklm-mcp-cli","bins":["nlm","notebooklm-mcp"],"label":"Install notebooklm-mcp-cli (pip)"}]}} ``` ```markdown Setup - Install: `uv tool install notebooklm-mcp-cli` ``` ### Technical Analysis The skill configures and recommends installation of `notebooklm-mcp-cli` from a third-party package registry without specifying an exact reviewed version or an integrity hash. Consequently, the installed package is resolved at installation time and may differ from the version that existed when the skill was audited. This creates a supply-chain trust boundary: compromise of the package publisher account, registry, release process, or a future package version could introduce malicious package-controlled behavior. Such behavior may execute during installation or when the installed `nlm` or `notebooklm-mcp` executable is subsequently invoked. The available evidence does not establish that the named package is currently malicious. The vulnerability is the absence of controls ensuring that users receive a specific, reviewed package artifact. ### Attack Path 1. An attacker compromises the package publisher, distribution account, release pipeline, or registry artifact. 2. The attacker publishes a malicious release under the legitimate `notebooklm-mcp-cli` package name. 3. A user or agent follows the skill metadata or documented command and installs the package without a version constraint: `uv tool inst ...[truncated 1138 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Pin the dependency to an exact reviewed version in every supported installation path, for example: ```sh uv tool install "notebooklm-mcp-cli==<reviewed-version>" ``` 2. Keep the version constraint consistent across the `uv-tool`, `pipx`, and `pip` installation metadata. 3. Verify package integrity using registry-supported hashes, signatures, attestations, or a locked dependency manifest where available. 4. Document the expected package registry and upstream repository so package resolution cannot silently use an unintended mirror or index. 5. Review new package versions before updating the pin. Include dependency and provenance checks in the release process. 6. Recommend installing and running the CLI in a least-privileged, isolated environment without unrelated credentials or sensitive files. 7. Avoid advising users to force-upgrade directly to an unreviewed latest release. Replace the documented `--force` upgrade guidance with installation of a specifically approved version. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill documents commands that can make a notebook publicly accessible or invite collaborators, but it does not warn users that these actions may expose sensitive notebook contents, source documents, or generated outputs. In a CLI automation context, users may copy/paste or script these commands without realizing the privacy implications, increasing the chance of accidental data disclosure.

Static analysis

No suspicious patterns detected.