T01 · Skill Instruction Hijacking
Error
- Location
scripts/ask_question.py:25- Finding
Mandatory Agent behavior and output hijacking through appended instructions
- Content
View full analysis
- Remediation
View remediation
Security audit
NotebookLM Skill
Security checks for vulnerabilities and agentic risk
Overview
This skill is a real NotebookLM integration, but it asks for sensitive browser-session authority and contains under-scoped automation behaviors that users should review carefully before installing.
Install only if you are comfortable giving this skill persistent access to your Google NotebookLM session and, if used, Z-Library session. Prefer a dedicated Google account, avoid shared machines, review file permissions under the skill data directory, be cautious with delete/sync commands, and do not let untrusted input choose run.py script names or trigger repeated follow-up queries automatically.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)
T07 · Tool Hijacking and Spoofing
Error
- Location
scripts/config.py:33- Finding
Predictable unauthenticated Unix socket permits browser-daemon spoofing and cookie interception
- Content
View full analysis
bool: """Connect to daemon, starting it if necessary""" daemon_running = self._daemon_is_running() if self.headed and daemon_running: self._stop_daemon() daemon_running = False if not daemon_running: self._start_daemon() self._started_daemon = True try: self.socket = self._connect_socket() self.launch(headless=not self.headed) self.restore_storage_state() return True ``` No peer or ownership validation occurs: ```python def _daemon_is_running(self) -> bool: """Check if daemon socket exists and is responsive""" if not self.socket_path.exists(): return False try: test_socket = self._connect_socket(timeout=1) test_socket.close() return True except Exception: return False def _connect_socket(self, timeout: int = 120) -> socket.socket: """Create a configured socket connection to the daemon""" sock ...[truncated 2645 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/auth_manager.py:610- Finding
Plaintext authentication state is stored without explicit restrictive permissions
- Content
View full analysis
dict: payload["notebooklm_auth_token"] = token payload["notebooklm_cookies"] = cookies payload["notebooklm_updated_at"] = datetime.now(timezone.utc).isoformat() auth_file.parent.mkdir(parents=True, exist_ok=True) auth_file.write_text(json.dumps(payload)) return {"auth_token": token, "cookies": cookies} ``` Per-account files are handled similarly: ```python def _ensure_directories(self) -> None: """Create necessary directories.""" GOOGLE_AUTH_DIR.mkdir(parents=True, exist_ok=True) ``` ```python # Save credentials file_path.write_text(json.dumps(credentials, indent=2)) ``` ```python account.file_path.write_text(json.dumps(credentials, indent=2)) return True ``` ### Technical Analysis The stored JSON can contain full browser cookies, local storage, session storage, NotebookLM authentication tokens, CSRF tokens, and session identifiers. The project does not explicitly set authentication directories to mode `0700` or credential files to mode `0600`. As a result, p ...[truncated 1661 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
requirements.txt:7- Finding
Automatic installation accepts unreviewed future dependency versions
- Content
View full analysis
=0.18 beautifulsoup4>=4.12.0 lxml>=4.9.0 # PDF text extraction fallback pypdf>=4.0.0 # NotebookLM API client notebooklm-py>=0.1.0 # Patchright for Google auth (anti-detection Playwright fork) patchright>=1.50.0 ``` Normal command execution automatically installs the accepted versions: ```python def ensure_pip_deps(): """Ensure pip dependencies are installed and up-to-date""" skill_dir = Path(__file__).parent.parent venv_dir = skill_dir / ".venv" requirements_file = skill_dir / "requirements.txt" hash_file = venv_dir / ".requirements.hash" if not requirements_file.exists(): return current_hash = _get_requirements_hash(requirements_file) if hash_file.exists(): stored_hash = hash_file.read_text().strip() if stored_hash == current_hash: return print("📦 Installing Python dependencies...") venv_python = get_venv_python() try: result = subprocess.run( [str(venv_python), "-m", "pip", "install", "-r", str(requirements_file), "--quiet"], capture_output=True, text=True, timeout=TIMEOUT_PIP_INSTALL ) ``` ### Technical Analysis A lower-bound requirement such as `patchright>=1.50.0` allows any future version satisfying that range. The exact code installed on a new system can therefore differ from what was present when the Skill was audited. The wrapper automatically performs installation during first-time setup or after the requirements file changes. Python packages can execute code during build and installation, and imported packages execute module initialization code during ordinary Skill use. No hash verification ...[truncated 1336 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/run.py:501- Finding
Runner path traversal allows execution of Python files outside the scripts directory
- Content
View full analysis
/attacker.py`. An absolute path can also override earlier path components under `pathlib` path-joining behavior. If the resulting file exists, the only validation performed is the existence check. The subprocess call does not use a shell, so this is not shell command injection. It is path traversal leading to unintended interpreter execution. ### Attack Path 1. An attacker or untrusted routing input influences the first argument passed to `scripts/run.py`. 2. The attacker supplies a path such as `../atta ...[truncated 1213 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
Findings (151)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
EPUB-to-Markdown conversion, HTML parsing, content splitting, and local file transformation are broader content-processing capabilities than the headline description suggests. While not necessarily malicious, they expand local data exposure and can cause users to underestimate the amount of document handling performed on their machine.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
EPUB-to-Markdown conversion, HTML parsing, content splitting, and local file transformation are broader content-processing capabilities than the headline description suggests. While not necessarily malicious, they expand local data exposure and can cause users to underestimate the amount of document handling performed on their machine.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
EPUB-to-Markdown conversion, HTML parsing, content splitting, and local file transformation are broader content-processing capabilities than the headline description suggests. While not necessarily malicious, they expand local data exposure and can cause users to underestimate the amount of document handling performed on their machine.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
EPUB-to-Markdown conversion, HTML parsing, content splitting, and local file transformation are broader content-processing capabilities than the headline description suggests. While not necessarily malicious, they expand local data exposure and can cause users to underestimate the amount of document handling performed on their machine.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
EPUB-to-Markdown conversion, HTML parsing, content splitting, and local file transformation are broader content-processing capabilities than the headline description suggests. While not necessarily malicious, they expand local data exposure and can cause users to underestimate the amount of document handling performed on their machine.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
EPUB-to-Markdown conversion, HTML parsing, content splitting, and local file transformation are broader content-processing capabilities than the headline description suggests. While not necessarily malicious, they expand local data exposure and can cause users to underestimate the amount of document handling performed on their machine.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
EPUB-to-Markdown conversion, HTML parsing, content splitting, and local file transformation are broader content-processing capabilities than the headline description suggests. While not necessarily malicious, they expand local data exposure and can cause users to underestimate the amount of document handling performed on their machine.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
EPUB-to-Markdown conversion, HTML parsing, content splitting, and local file transformation are broader content-processing capabilities than the headline description suggests. While not necessarily malicious, they expand local data exposure and can cause users to underestimate the amount of document handling performed on their machine.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
EPUB-to-Markdown conversion, HTML parsing, content splitting, and local file transformation are broader content-processing capabilities than the headline description suggests. While not necessarily malicious, they expand local data exposure and can cause users to underestimate the amount of document handling performed on their machine.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
EPUB-to-Markdown conversion, HTML parsing, content splitting, and local file transformation are broader content-processing capabilities than the headline description suggests. While not necessarily malicious, they expand local data exposure and can cause users to underestimate the amount of document handling performed on their machine.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
EPUB-to-Markdown conversion, HTML parsing, content splitting, and local file transformation are broader content-processing capabilities than the headline description suggests. While not necessarily malicious, they expand local data exposure and can cause users to underestimate the amount of document handling performed on their machine.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
EPUB-to-Markdown conversion, HTML parsing, content splitting, and local file transformation are broader content-processing capabilities than the headline description suggests. While not necessarily malicious, they expand local data exposure and can cause users to underestimate the amount of document handling performed on their machine.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
EPUB-to-Markdown conversion, HTML parsing, content splitting, and local file transformation are broader content-processing capabilities than the headline description suggests. While not necessarily malicious, they expand local data exposure and can cause users to underestimate the amount of document handling performed on their machine.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
EPUB-to-Markdown conversion, HTML parsing, content splitting, and local file transformation are broader content-processing capabilities than the headline description suggests. While not necessarily malicious, they expand local data exposure and can cause users to underestimate the amount of document handling performed on their machine.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
EPUB-to-Markdown conversion, HTML parsing, content splitting, and local file transformation are broader content-processing capabilities than the headline description suggests. While not necessarily malicious, they expand local data exposure and can cause users to underestimate the amount of document handling performed on their machine.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
EPUB-to-Markdown conversion, HTML parsing, content splitting, and local file transformation are broader content-processing capabilities than the headline description suggests. While not necessarily malicious, they expand local data exposure and can cause users to underestimate the amount of document handling performed on their machine.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
The documentation includes a direct file deletion command targeting the notebook library JSON. In an agent-assisted or copy-paste workflow, this can lead to irreversible loss of notebook metadata if the backup step is skipped, fails, or is stale, making it an unsafe destructive parameterized action.
- Content
md cp ~/.claude/skills/notebooklm/data/library.json library.backup.json # Reset library rm ~/.claude/skills/notebooklm/data/library.json # Re-add notebooks python scripts/run.py notebook_manager.py add --url ... --name ...
Unvalidated Output Injection
High
- Category
- Output Handling
- Confidence
- 85% confidence
- Finding
Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.
- Content
python # Query documentation during development def check_api_usage(api_endpoint): result = subprocess.run([ "python", "scripts/run.py", "ask_question.py", "--question", f"Parameters and response format for {api_endpoint}", "--notebook-id", "api-docs"
Env Variable Harvesting
High
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
- Content
python """Start the agent-browser daemon""" print("🚀 Starting browser daemon...") env = os.environ.copy() env["AGENT_BROWSER_SESSION"] = self.session_id daemon_script = SKILL_DIR / "node_modules" / "agent-browser" / "dist" / "daemon.js"
Env Variable Harvesting
High
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
- Content
python """Start the agent-browser daemon""" print("🚀 Starting browser daemon...") env = os.environ.copy() env["AGENT_BROWSER_SESSION"] = self.session_id daemon_script = SKILL_DIR / "node_modules" / "agent-browser" / "dist" / "daemon.js"
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The manifest frames this skill as a notebook querying tool for source-grounded answers, but this file adds separate artifact-management capabilities including deleting artifacts, generating media, and downloading files. Those are materially broader operations than query-only access and change both the remote NotebookLM state and the local filesystem.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This code explicitly uses an anti-detection browser workflow to bypass Google's 'browser not secure' automation protections. Deliberately evading platform security controls is dangerous because it enables automated harvesting and reuse of authenticated sessions in ways the provider is trying to prevent, and it is not necessary for a simple user-facing query skill.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The generated instructions explicitly promote adding sources from Z-Library, which is unrelated to the stated direct-query NotebookLM purpose and introduces a pathway to acquire third-party copyrighted content through the skill workflow. In a coding-assistant skill, embedding this capability is more dangerous because it normalizes and operationalizes external content acquisition under a benign research/querying label.
- Content
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
python ) parser.add_argument("--ai", type=str, help="AI platform to initialize for") parser.add_argument("--target", type=Path, help="Target directory (default: current directory)") parser.add_argument("--force", action="store_true", help="Overwrite existing files") parser.add_argument("--list", action="store_true", help="List available platforms") args = parser.parse_args()
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill is presented as a query tool, but this wrapper exposes broad state-changing capabilities including create, rename, delete, upload, and artifact management. In an agent setting, this is dangerous because users or policy layers may grant it based on a read-oriented description while the code can modify or destroy NotebookLM data and trigger additional actions beyond expected scope.
- Content
Static analysis
No suspicious patterns detected.