X To Notebooklm

• Analyzed: May 11, 2026, 5:40 AM
• Findings: 1
• Version: 1.0.1
• Hash: 89de2b11250b62690dd63eb3c027a3258c21a986f80d0b0018e817fc6022dc2f
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill contains a critical shell injection vulnerability in `scripts/x-to-notebooklm.mjs` due to the use of `execSync` with unsanitized user-controlled inputs (specifically the `url`, `notebookName`, and `notebookId` parameters). While the script's logic aligns with its stated purpose of fetching content via `r.jina.ai` and uploading to NotebookLM, the lack of input sanitization allows for arbitrary command execution if a crafted URL or notebook name is provided. No clear evidence of intentional malice, data exfiltration, or obfuscation was found.