Security audit

Phy Notebooklm

Security checks for vulnerabilities and agentic risk

Overview

The skill is purpose-aligned for NotebookLM use, but it asks agents to handle Google session state and upload local files while giving inconsistent privacy and persistence guidance.

Install only if you are comfortable with a skill storing Google NotebookLM browser session data locally and potentially uploading selected files to Google. Before using uploads, confirm the exact files or directories and prefer dry-run first; use the documented cleanup command or clear authentication when finished.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The skill claims that each query uses a fresh browser session and closes, but elsewhere documents persistent authentication and stored browser state/cookies. This inconsistency can mislead users and downstream agents about data retention, privacy boundaries, and whether cross-query/session contamination is possible.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The trigger guidance includes broad natural-language phrases like 'check my docs' and 'query my notebook,' which may cause the skill to activate in contexts the user did not intend. Because this skill can authenticate to Google services, query remote notebooks, and upload files, unintended activation could lead to unnecessary external data access or transmission.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The upload workflow sends local files to Google NotebookLM but does not require a prominent user-facing warning or explicit consent acknowledging third-party transmission. In a skill context with access to local course directories and batch upload support, this creates a meaningful risk of accidental exfiltration of sensitive or proprietary documents to an external service.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The stated limitation of 'No session persistence' contradicts the documented storage of auth state and browser cookies/session data. Such contradictory security claims can cause unsafe user assumptions about isolation and retention, increasing the risk of accidental exposure of authenticated state or sensitive notebook access.

Static analysis

No suspicious patterns detected.