ClawHub
Back to skill

Security audit

noteboklm

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent NotebookLM integration, but it gives agents broad authority to upload documents, change account/context state, and manage sharing with too little confirmation and dependency control.

Review this skill carefully before installing. Use a dedicated Google account or isolated profile, avoid uploading sensitive or regulated documents unless you explicitly intend to send them to NotebookLM, confirm exact files and notebook IDs before source import, and manually approve any export or sharing change, especially public links or editor permissions. Prefer a pinned/audited version of the underlying notebooklm-py dependency.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:61
Finding

State-Changing and Sensitive Upload Operations Allowed Without Explicit Confirmation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:61-69
Vulnerability Type: Authorization boundary and least-privilege violation
Risk Level: Medium

markdown
**Run without confirmation:**
- `notebooklm status`, `list`, `doctor` — read-only
- `notebooklm auth check` — diagnostics
- `notebooklm create` — create notebook
- `notebooklm use <id>` — set context (⚠️ single-agent only; use `-n` in parallel)
- `notebooklm source add` — add sources
- `notebooklm ask "..."` — chat (without `--save-as-note`)
- `notebooklm language list/get/set` — language settings
- `notebooklm profile list/create/switch` — profile management

Technical Analysis

The no-confirmation list combines read-only diagnostics with operations that modify local or remote state. In particular:

  • notebooklm source add can transmit local documents to Google NotebookLM.
  • notebooklm create creates remote resources.
  • notebooklm language set changes a global account setting.
  • Profile creation and switching modify authentication or execution context.
  • notebooklm use writes shared local state, as acknowledged by the parallel-agent warning elsewhere in the Skill.

These operations should not inherit the same authorization policy as read-only commands. Broad activation phrases such as “Analyze these documents” can cause the Skill to handle sensitive local material, but the policy does not require disclosure of the files being uploaded, the destination account, or the resulting state changes.

Attack Path

  1. A user requests analysis of one or more local documents.
  2. The broad intent rules activate the NotebookLM Skill.
  3. The agent follows the instruction allowing notebooklm source add without confirmation.
  4. The selected files are uploaded to the authenticated Google account through the unofficial NotebookLM client.
  5. The data leaves the local environment without a separate, informed upload decision from ...[truncated 677 chars]
Remediation
View remediation

Remediation Suggestions

  • Restrict no-confirmation execution to genuinely read-only operations such as status, list, and non-mutating diagnostics.
  • Require explicit approval before uploading any local file or pasted content.
  • Before approval, display the exact source paths, destination Google account or profile, notebook identifier, and intended operation.
  • Require confirmation before notebook creation, profile creation or switching, context changes, and global language changes.
  • Prefer per-command language overrides instead of modifying the global language setting.
  • Use explicit notebook identifiers through -n <notebook_id> rather than shared active-notebook state.
  • Apply isolated profiles or NOTEBOOKLM_HOME directories for concurrent agents.
  • Add data-classification checks that block uploading credential files, private keys, environment files, or other sensitive material unless the user explicitly overrides the warning.

T08 · Insecure Dependencies

Warning
Location
README.md:3
Finding

Automatically Installed Unpinned Unofficial Authentication Dependency

Content
View full analysis

Vulnerability Details

File Location: README.md:3-7 and README.md:46-51
Vulnerability Type: Uncontrolled third-party dependency and supply-chain exposure
Risk Level: Medium

markdown
Full Google NotebookLM integration for OpenClaw — programmatic access to all Studio features.

> OpenClaw handles installation and setup automatically.

**Source library:** [teng-lin/notebooklm-py](https://github.com/teng-lin/notebooklm-py)
**⚠️ Unofficial** — Uses undocumented Google APIs. May break without notice.
markdown
## First-Time Setup

OpenClaw installs the library. You only need to authenticate once:

```bash
notebooklm login    # Opens browser — log in with Google account
notebooklm list     # Confirm it works
text

### Technical Analysis

The project delegates installation to OpenClaw and identifies an unofficial upstream library, but it provides no exact version, audited commit, package hash, signature requirement, lockfile, or reproducible installation procedure. Only `README.md` and `SKILL.md` are present, so the reviewed artifact contains no dependency manifest that constrains the installed implementation.

This dependency is security-sensitive because it performs Google authentication, accesses NotebookLM data, uploads local files, and manages sharing permissions. Automatically resolving an unspecified upstream version means the effective implementation can change independently of the reviewed Skill text.

The audit found no evidence that the current upstream library is malicious. The vulnerability is the absence of dependency pinning and integrity controls around an authentication-capable, automatically installed unofficial component.

### Attack Path

1. The upstream repository, package release, maintainer account, or dependency-resolution path is compromised or publishes an unsafe update.
2. OpenClaw installs the unspecified current version because the Skill does not pin or verify
...[truncated 733 chars]
Remediation
View remediation

Remediation Suggestions

  • Pin the dependency to a reviewed release and immutable commit identifier.
  • Publish and verify cryptographic hashes for the resolved package and all transitive dependencies.
  • Add a lockfile or equivalent dependency manifest to the reviewed project.
  • Document the exact package source, installation command, expected package name, and version.
  • Disable automatic upgrades and require security review before changing the pinned revision.
  • Prefer signed releases and verify signatures during installation.
  • Install the client in a restricted environment with only the filesystem and network access required for the requested task.
  • Minimize Google account privileges and use a dedicated account or profile for automation.
  • Document where authentication material is stored and enforce restrictive filesystem permissions.

T09 · Insecure Skill Coding Practices

Note
Location
SKILL.md:31
Finding

State-Changing Environment Repair Included in Mandatory Readiness Verification

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:31-35
Vulnerability Type: Unsafe automatic environment modification
Risk Level: Low

markdown
**Verify readiness before any workflow:**
```bash
notebooklm status         # Active notebook and session
notebooklm doctor         # Environment health check
notebooklm doctor --fix   # Auto-fix issues
text

### Technical Analysis

The Skill instructs agents to verify readiness before every workflow and includes `notebooklm doctor --fix` in that mandatory block. Unlike `status` and a diagnostic-only `doctor` invocation, `doctor --fix` is explicitly state-changing.

The project does not document which files, packages, permissions, credentials, or configuration values the repair command may modify. It also does not place this command in the confirmation-required list. Consequently, an otherwise read-only user request can trigger environment changes whose scope cannot be determined from the reviewed artifact.

### Attack Path

1. A user submits any request that activates the Skill.
2. The agent follows the mandatory readiness instructions.
3. The agent runs `notebooklm doctor --fix` without first presenting detected problems or proposed changes.
4. The external CLI modifies its environment or configuration according to implementation behavior not defined in this project.
5. Those modifications may affect subsequent commands or other users and agents sharing the environment.

### Impact Assessment

The confirmed impact is unauthorized modification of the NotebookLM CLI environment or configuration. The exact files and privileges affected cannot be established from the two reviewed documentation files. There is no evidence that the command establishes persistence or executes a malicious payload, so the risk is limited to opaque and unnecessary state changes.
Remediation
View remediation

Remediation Suggestions

  • Remove notebooklm doctor --fix from the mandatory readiness sequence.
  • Run only the read-only notebooklm doctor diagnostic by default.
  • Display detected problems and the exact proposed repairs before making changes.
  • Require explicit user confirmation before invoking the repair operation.
  • Document every file, directory, package, credential store, and configuration field that the repair command may alter.
  • Provide a dry-run mode and backup or rollback procedure.
  • Avoid running repair operations for workflows that only require read-only status checks.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The README advertises extensive source ingestion, export, and sharing capabilities, including full-text access, web research, Google Docs/Sheets export, and permission management, but does not warn users about privacy, consent, or data-governance risks. In a skill that programmatically moves content between external services and can manage sharing, omission of those warnings increases the chance of accidental exposure of sensitive documents, overbroad sharing, or unauthorized secondary use of imported data.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

The skill authorizes several actions to run without confirmation, including creating notebooks, setting active context, adding sources, and managing profiles. While some are low risk, others mutate remote state, ingest potentially sensitive data, or change shared execution context, which can lead to unintended data import, context confusion, or side effects when triggered by ambiguous user intent or concurrent agents.

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

md
## Autonomy Rules

**Run without confirmation:**
- `notebooklm status`, `list`, `doctor` — read-only
- `notebooklm auth check` — diagnostics
- `notebooklm create` — create notebook

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The export commands send notebook-derived content to Google Docs or Sheets, which is an external persistence and sharing surface, but the skill does not warn that this transmits and stores content outside the immediate notebook context. That omission can cause accidental disclosure, retention, or broader access to sensitive material when used by an autonomous or semi-autonomous agent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill documents commands that can change notebook sharing state and grant access to other users, including enabling public sharing and elevating permissions to editor, without an explicit privacy/security warning. In an agent setting, this increases the risk that a user or downstream automation triggers data exposure of notebook sources, notes, and chats without understanding the access impact.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.