Security audit

nlm

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward NotebookLM CLI helper skill, but users should be careful with public sharing, collaborator invites, and installing the unpinned third-party CLI package.

Before installing, confirm you trust the notebooklm-mcp-cli package source. Before running share or invite commands, review notebook contents and recipients because sources, notes, and generated outputs may become visible outside your account. Treat MCP setup and skill update commands as persistent configuration changes.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:5
Finding: Unpinned Third-Party CLI Dependency Installation
Content: View full analysis
Remediation: View remediation
" ``` 2. Keep the version constraint consistent across the `uv-tool`, `pipx`, and `pip` installation metadata. 3. Verify package integrity using registry-supported hashes, signatures, attestations, or a locked dependency manifest where available. 4. Document the expected package registry and upstream repository so package resolution cannot silently use an unintended mirror or index. 5. Review new package versions before updating the pin. Include dependency and provenance checks in the release process. 6. Recommend installing and running the CLI in a least-privileged, isolated environment without unrelated credentials or sensitive files. 7. Avoid advising users to force-upgrade directly to an unreviewed latest release. Replace the documented `--force` upgrade guidance with installation of a specifically approved version. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill documents commands that can make a notebook publicly accessible or invite collaborators, but it does not warn users that these actions may expose sensitive notebook contents, source documents, or generated outputs. In a CLI automation context, users may copy/paste or script these commands without realizing the privacy implications, increasing the chance of accidental data disclosure.
Content: No source excerpt is available for this finding.