notebooklm-cli

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:40 AM UTC
• Version: 0.1.0

Overview

The skill is a coherent NotebookLM CLI guide, but it relies on browser session cookie extraction and broad account actions without enough security and privacy disclosure.

Review carefully before installing or using. Treat nlm login as handling active Google session credentials, avoid running it on shared or untrusted machines, verify where the CLI stores profiles/cookies, and do not import confidential Drive files, pasted text, URLs, or bulk notebook content unless you are comfortable sending that material to NotebookLM/Google processing. Avoid privileged Docker flags unless you understand the container impact.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (10)

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

udio overviews (podcasts) from notebook sources

• Creating study materials: quizzes, flashcards, reports
• Producing visual content: slides, infographics, mind maps, videos
• Querying sources via chat or one-shot questions
• Researching and importing new sources automatically

Quick Start

Authentication

bash

nlm login

Launches Chrome, navigates to NotebookLM, and extracts session cookies. Requires Google Chrome installed.

List Notebooks

bash

nlm notebook list

Create Notebook and Add Sources

bash

nlm notebook create "My Research"
nlm source add <notebook-id> --url "https://example.com/article"
nlm source add <notebook-id> --text "Your content here" --title "My Notes"

Generate Content (All Types)

All generation commands require --confirm or -y:

bash

nlm audio create <id> --confirm          # Podcast
nlm report create <id> --confirm         # Briefing doc or study guide
nlm quiz create <id> --confirm           # Quiz questions
nlm f

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · references/commands.md (reported line 230)May include surrounding context.

md

**REPL Commands:**
- `/sources` - Show sources
- `/clear` - Clear conversation
- `/help` - Show help
- `/exit` - Exit session

Privileged Container / Container Escape

High

• Category: Privilege Escalation
• Confidence: 85% confidence

Finding

Potential security issue detected. Manual review is recommended.

Content

Scanner excerpt · references/troubleshooting.md (reported line 250)May include surrounding context.

md

### Docker/Containers
- Chrome must be installed in container
- May need `--cap-add=SYS_ADMIN`
- DISPLAY environment variable must be set

### Remote Servers

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill explicitly states that nlm login extracts browser session cookies from Chrome, which involves handling highly sensitive authentication material. Even if this is for legitimate session reuse, the documentation provides no warning about the sensitivity of those cookies, storage/retention expectations, or the risk of account takeover if they are exposed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The research and import commands send user queries and potentially imported source content to external services, but the skill does not disclose that data may leave the local environment. This creates a privacy and data-governance risk, especially if users run the commands on proprietary, regulated, or confidential material without understanding the transmission boundary.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation explicitly states that authentication works by launching Chrome and extracting session cookies, but it provides no warning that these cookies are bearer credentials that can grant account access if mishandled. In a security-sensitive skill, normalizing cookie extraction without guidance on secure storage, scope limitation, or user consent increases the risk of credential theft or unsafe operator behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The source import commands allow adding URLs, free-form text, YouTube content, and Drive documents, but the reference omits any warning that this material will be transmitted to and processed by an external service. That can lead users to upload sensitive, proprietary, or regulated data without understanding the privacy implications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The workflow instructs users to add Google Drive and web sources but does not disclose that document contents and linked material may be transmitted to and processed by the external service. In a documentation/agent-skill context, this omission can cause users to upload sensitive internal or personal data without informed consent, making the issue a real privacy and data-handling risk rather than a purely cosmetic docs gap.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The automated research/import workflow encourages users to discover and import external sources directly into a notebook without a review gate or warning about untrusted content ingestion. This is dangerous because it can silently expand the notebook with irrelevant, copyrighted, sensitive, or maliciously crafted sources, which may then influence downstream generated outputs and expose users to data-quality and privacy issues.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The batch scripting examples operate across all notebooks and trigger content generation in bulk without warning about the account-wide scope, possible costs, processing of sensitive notebook contents, or irreversible side effects. In an automation-oriented skill, users may copy-paste these commands directly, causing unintended actions at scale and broad exposure of stored content to generation workflows.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.