Notebooklm Integration

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:31 AM UTC
• Version: 1.0.1

Overview

The skill is a coherent NotebookLM integration, but it asks users to trust mutable unofficial code while enabling sensitive Google account, Drive, sharing, export, and deletion actions without enough guardrails.

Review this skill before installing. Use a dedicated Python environment and a least-privilege Google account, pin and verify the notebooklm-py dependency if possible, and require explicit approval before deleting notebooks, sharing notebooks, exporting content, importing Drive files, or processing sensitive local files.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:31

Finding

Unpinned Unofficial Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 31-35 and 156-166
Vulnerability Type: Supply-chain exposure through an unpinned, unofficial third-party dependency
Risk Level: Medium

The skill directs users to install and execute the unofficial notebooklm-py package without pinning an audited version, verifying package hashes, using a lockfile, or pinning the source repository to an immutable commit.

Relevant code snippets:

SKILL.md, lines 31-35:

bash

### Installation
First, ensure you have the notebooklm-py library installed:
```bash
pip install notebooklm-py

text

`SKILL.md`, lines 156-166:

```bash
1. Clone or pull the latest version of the notebooklm-py repository:
   ```bash
   git clone https://github.com/teng-lin/notebooklm-py.git
   # or if you already have it:
   cd notebooklm-py && git pull
   ```

2. Re-run the installation process:
   ```bash
   pip install -e .  # for development mode, or just pip install notebooklm-py
   ```

Technical Analysis

Both installation methods resolve mutable external content at installation time. The package-index command does not constrain the dependency to a reviewed version or verify its integrity with a cryptographic hash. Consequently, the installed code may differ between executions.

The repository workflow similarly clones or pulls the latest mutable branch and then performs an editable installation. Python package installation can invoke attacker-controlled build backends or packaging hooks, while subsequent imports execute the installed package's runtime code. An editable installation also makes the environment directly dependent on the mutable repository checkout.

This is especially sensitive because the documented integration uses Google authentication and processes notebook sources, local files, generated artifacts, and potentially Google Drive content. Although no malicious implementation is ...[truncated 1576 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the package to a specifically reviewed version rather than installing the latest available release:

   bash

   python -m pip install "notebooklm-py==REVIEWED_VERSION"
   

2. Require cryptographic hashes for the package and all transitive dependencies, using a reviewed requirements file:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

3. Provide a lockfile generated from an audited dependency set and review dependency changes before updating it.

4. For source installations, check out an immutable, reviewed commit rather than a mutable branch:

   bash

   git clone https://github.com/teng-lin/notebooklm-py.git
   cd notebooklm-py
   git checkout REVIEWED_COMMIT_SHA
   

5. Verify the commit or release signature and compare it against a trusted value before installation.

6. Avoid editable installations for ordinary users. Build a wheel from reviewed source, inspect the build configuration, and install the resulting immutable artifact.

7. Install the dependency inside a dedicated virtual environment or sandbox under a non-privileged account. Do not run installation commands as root or with unnecessary system permissions.

8. Review package metadata, build-system configuration, installation hooks, runtime network behavior, and transitive dependencies before approving an update.

9. Limit the integration process's access to authentication tokens, local files, environment variables, and Google resources according to least-privilege principles.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

The skill includes instructions to update itself by cloning or pulling code directly from a GitHub repository and reinstalling it. In an agent environment, self-modification or externally sourced updates can bypass review, introduce supply-chain risk, and change the skill's behavior after deployment.

Content

Scanner excerpt · SKILL.md (reported line 162)May include surrounding context.

Updating the Skill

To update this skill to the latest version from the GitHub repository, follow these steps:

1. Clone or pull the latest version of the notebooklm-py repository:

   bash

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill advertises destructive actions (delete notebooks) and data-exporting/sharing capabilities without clearly warning that these operations can remove user data or move sensitive content outside its original boundary. In an agent setting, broad operational descriptions without explicit confirmation and sensitivity guidance increase the chance of unsafe execution or unintended disclosure.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.