NotebookLM Skill

• Outcome: Review
• Latest audit: May 28, 2026 · 5:51 AM UTC
• Version: 1.0.1

Overview

The skill is mostly coherent with its NotebookLM purpose, but it asks for sensitive Google session access and includes anti-detection automation, Z-Library downloading, and rate-limit workarounds that warrant Review before installation.

Install only if you are comfortable granting this skill access to authenticated Google NotebookLM sessions and local documents. Use a dedicated Google account, review the auth files under data/auth, avoid Z-Library workflows unless you have rights to the material, do not use account rotation to bypass limits, and treat generated downloads or folder sync deletes as real changes to your local and NotebookLM data.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (78)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

package_json = skill_dir / "package.json"
            if package_json.exists():
                print("   Installing Node.js dependencies...")
                subprocess.run(
                    ["npm", "install"],
                    check=True,
                    capture_output=True,

• Confidence: 95% confidence
• Finding: Importing this package can trigger `npm install` automatically, which executes lifecycle scripts from package dependencies and the local package itself. That means merely importing Python code can result in arbitrary code execution through the Node package manager, making the skill substantially more dangerous than its stated notebook-querying purpose suggests.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

capture_output=True,
                    cwd=str(skill_dir)
                )
                subprocess.run(
                    ["npm", "run", "install-browsers"],
                    check=True,
                    capture_output=True,

• Confidence: 96% confidence
• Finding: This import-time subprocess runs `npm run install-browsers`, which executes an arbitrary project-defined script from `package.json`. Because npm scripts are fully programmable, this is effectively arbitrary local code execution triggered by import, and it expands the attack surface beyond normal use of the skill.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

print("📦 Installing Python dependencies...")
    venv_python = get_venv_python()
    try:
        result = subprocess.run(
            [str(venv_python), "-m", "pip", "install", "-r", str(requirements_file), "--quiet"],
            capture_output=True,
            text=True,

• Confidence: 88% confidence
• Finding: The runner automatically performs `pip install -r requirements.txt` at execution time, which causes network package installation and execution of package setup/build hooks from the local skill directory without an explicit trust gate. In an agent-skill context, this creates a supply-chain and arbitrary code execution risk if the skill contents or dependency sources are malicious or tampered with.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if os.name == 'nt':
            patchright_cmd = skill_dir / ".venv" / "Scripts" / "patchright.exe"

        result = subprocess.run(
            [str(patchright_cmd), "install", "chromium"],
            capture_output=True,
            text=True,

• Confidence: 86% confidence
• Finding: This automatically downloads and installs a browser runtime via the `patchright` tool during script execution. In this skill context, automatic retrieval and installation of executable components expands the trusted computing base and creates a supply-chain risk similar to unattended package installation.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# Pass remaining args to init_platform.py
        init_args = sys.argv[2:]
        cmd = [sys.executable, str(init_script)] + init_args
        result = subprocess.run(cmd)
        sys.exit(result.returncode)

    # Handle --check-deps flag for pre-flight dependency check

• Confidence: 84% confidence
• Finding: The runner forwards arbitrary user-provided arguments to `init_platform.py` and executes it automatically. While shell injection is avoided, this generic dispatcher pattern can expose privileged initialization functionality without additional policy checks, which is risky in an agent skill that may be triggered indirectly.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# Run the script
    try:
        result = subprocess.run(cmd)
        sys.exit(result.returncode)
    except KeyboardInterrupt:
        print("\n⚠️ Interrupted by user")

• Confidence: 89% confidence
• Finding: The script acts as a generic launcher for any file name under `scripts/`, taking user-supplied script names and arguments and executing them in the venv. Although it avoids shell injection, this broad execution surface is dangerous in an agent-integrated skill because it enables invocation of sensitive helper scripts and expands the effect of prompt- or tool-driven misuse.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# Run setup with system Python
        try:
            result = subprocess.run(
                [sys.executable, str(setup_script)],
                timeout=TIMEOUT_VENV_SETUP
            )

• Confidence: 87% confidence
• Finding: On first run, the runner automatically executes `setup_environment.py`, which can perform arbitrary setup logic from the skill repository. In this context that means unreviewed code from the skill is executed before any meaningful trust decision, creating a strong arbitrary code execution and persistence risk.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

print("📦 Installing agent-browser...")
        npm_cmd = _get_npm_command()
        try:
            result = subprocess.run(
                [npm_cmd, "install"],
                cwd=str(skill_dir),
                capture_output=True,

• Confidence: 88% confidence
• Finding: The runner automatically executes `npm install` when `node_modules` is absent, which can run package lifecycle scripts and fetch code from the network. In an agent skill, unattended npm installation materially increases remote code execution and supply-chain exposure.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

)

                # Install requirements
                result = subprocess.run(
                    [str(self.venv_pip), "install", "-r", str(self.requirements_file)],
                    check=True,
                    capture_output=True,

• Confidence: 87% confidence
• Finding: Installing dependencies from requirements.txt during setup executes package installation logic from whatever packages and versions that file specifies. In an agent skill context, this is more dangerous because a user may run setup on unreviewed third-party skill code, enabling dependency-confusion or malicious-package execution during installation.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

print("📦 Installing Node.js dependencies...")
                    npm_cmd = _get_npm_command()
                    try:
                        subprocess.run(
                            [npm_cmd, "install"],
                            check=True,
                            capture_output=True,

• Confidence: 89% confidence
• Finding: Running npm install in the skill directory can execute package lifecycle scripts such as preinstall, install, and postinstall from package.json and transitive dependencies. In this skill context, that is a meaningful code-execution risk because setup is automated and may be performed on untrusted skill content, so opening the repository can lead to arbitrary local command execution.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

print("✅ Node.js dependencies installed")
                        print("🌐 Installing Playwright browsers...")
                        try:
                            subprocess.run(
                                [npm_cmd, "run", "install-browsers"],
                                check=True,
                                capture_output=True,

• Confidence: 85% confidence
• Finding: npm run install-browsers executes a package-defined script from package.json, which is arbitrary code controlled by the repository. Because this file performs that action automatically as part of environment setup, a malicious or compromised skill can trigger attacker-defined commands on the host during installation.

Context-Inappropriate Capability

Medium

• Confidence: 80% confidence
• Finding: The advertised Z-Library integration expands the skill beyond normal NotebookLM querying into third-party content acquisition, including browser automation and credential/state handling. That materially increases legal, trust, and supply-chain risk because the skill can fetch external content from a high-risk source unrelated to the core querying function.

Context-Inappropriate Capability

High

• Confidence: 91% confidence
• Finding: The documented Z-Library upload flow materially broadens the skill from NotebookLM querying into acquisition and transfer of third-party content through browser automation. In an agent context, this can facilitate unauthorized downloading of copyrighted material and ingestion of untrusted content under innocuous source-management commands.

Context-Inappropriate Capability

Low

• Confidence: 78% confidence
• Finding: The documentation explicitly recommends switching or using multiple Google accounts to work around service rate limits. That guidance encourages policy circumvention and can lead users to store and manage multiple authenticated accounts in the skill, increasing account-abuse and privacy risk.

Description-Behavior Mismatch

Medium

• Confidence: 82% confidence
• Finding: The troubleshooting guide documents notebook creation/addition and multi-account management capabilities that materially expand the skill beyond its stated purpose of directly querying existing notebooks. This increases the operational scope of the skill and can enable unintended data access or account manipulation workflows that users would not reasonably expect from the manifest.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The guide explicitly recommends switching and rotating multiple Google accounts to bypass NotebookLM query rate limits. That is an abuse-enabling workflow that facilitates circumvention of provider safeguards and could lead to policy violations, account misuse, or broader unauthorized automated access.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: Advising users to enable less secure app access and use dedicated automation accounts normalizes weaker account security in support of browser automation. Even if intended for troubleshooting, this increases exposure to account compromise and encourages credential-handling practices outside the skill's stated query-only function.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The inclusion of ebook conversion and parsing libraries is not aligned with the stated purpose of querying existing NotebookLM notebooks, which suggests capability creep beyond the declared functionality. In an agent skill, extra document-ingestion tooling can enable unadvertised acquisition or transformation of external content, increasing attack surface and creating suspicion around undocumented data flows.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The dependency on Patchright, explicitly described as an anti-detection Playwright fork for Google auth, materially exceeds a simple NotebookLM query client and indicates stealth browser automation designed to evade detection. In the context of an agent skill with persistent auth, this creates a strong risk of unauthorized account automation, policy evasion, and abuse of user sessions.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The module calls `ensure_venv_and_run()` at import time, causing environment creation and package-manager activity as a side effect of importing the package. This violates least surprise and can trigger network access and code execution in contexts that only intended to inspect or import the module, which is a meaningful security concern for an agent skill.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The skill is presented as a NotebookLM query helper, but it silently starts a local browser daemon and associated automation stack. That mismatch matters because users may authorize a narrow notebook-query tool while unknowingly granting persistent browser automation capability, increasing the chance of unintended local actions and access to authenticated web sessions.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The evaluate() method forwards arbitrary JavaScript into the active page context, enabling unrestricted DOM access and interaction with authenticated web content. In a skill whose stated purpose is querying NotebookLM, this is an unnecessary and dangerous expansion of capability because it can read page data, trigger actions, or manipulate sessions far beyond source-grounded notebook queries.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: This command set includes destructive and state-changing operations such as artifact deletion, which materially exceeds the skill's stated query-focused purpose. That mismatch is security-relevant because users or higher-level agents may grant trust based on the manifest description and unknowingly enable capabilities that can remove data or alter remote state.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The file can generate new media artifacts (audio, slides, infographics), which goes beyond the advertised notebook-query functionality. In an agent setting, undeclared generation features can be abused for cost-incurring actions, unwanted content creation, or workflow manipulation because the operator may not realize the skill has write/create semantics.

Description-Behavior Mismatch

Low

• Confidence: 84% confidence
• Finding: The code supports downloading remote artifacts to arbitrary local file paths, but this local file write behavior is not reflected in the query-oriented description. In a trusted-agent context, undeclared file-write capability increases risk because it can be used to overwrite files, place unexpected content on disk, or facilitate data exfiltration workflows under misleading expectations.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.