ClawHub
Back to skill

Security audit

OpenClaw Expert Brain

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed OpenClaw help tool that queries NotebookLM, with normal privacy and dependency cautions before use.

Install this only if you are comfortable using a third-party nlm/NotebookLM CLI with Google authentication and sending your OpenClaw questions to that service. Prefer installing a reviewed, pinned version of notebooklm-mcp-cli in an isolated environment, and do not include credentials, private customer data, or internal secrets in questions.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:43
Finding

Unpinned Runtime Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:43
Vulnerability Type: Unpinned third-party runtime dependency
Risk Level: Medium

Complete Code Snippet:

markdown
- `nlm` CLI instalado: `pip install notebooklm-mcp-cli`

The same unsafe installation instruction also appears in README.md:13:

bash
pip install notebooklm-mcp-cli

The dependency manifest does not declare the required CLI and instead contains only an unrelated package at requirements.txt:1:

text
python-dotenv==1.0.0

Technical Analysis

The project instructs users to install notebooklm-mcp-cli without pinning an exact reviewed version or verifying an integrity hash. Consequently, the command resolves mutable third-party package content from the configured Python package index at installation time.

The installed package supplies the nlm executable invoked by scripts/ask.py:18-24:

python
result = subprocess.run(
    ["nlm", "notebook", "query", nb_id, question],
    capture_output=True,
    text=True,
    timeout=60
)

Because requirements.txt omits the actual runtime dependency, the project provides no reproducible or centrally auditable version constraint for it. This creates supply-chain exposure if a future package version is compromised, maliciously modified, or introduces unsafe behavior.

Attack Path

  1. An attacker compromises the package publisher account, distribution channel, or a future release of notebooklm-mcp-cli.
  2. A user follows the documented pip install notebooklm-mcp-cli instruction.
  3. The package manager retrieves the attacker-controlled release because no exact version or hash is required.
  4. Malicious installation hooks may execute during installation, or malicious runtime code may be installed as the nlm executable.
  5. When scripts/ask.py invokes nlm, the compromised executable runs with the privileges and ...[truncated 565 chars]
Remediation
View remediation

Remediation Suggestions

  1. Declare notebooklm-mcp-cli in the project dependency manifest using an exact, reviewed version.

  2. Generate and distribute a lockfile or hash-locked requirements file. Install with hash enforcement, for example:

    bash
    python -m pip install --require-hashes -r requirements.txt

  3. Update SKILL.md and README.md so installation uses the audited manifest rather than an unconstrained package name.

  4. Verify package provenance and configure an approved package index explicitly in deployment environments.

  5. Review and test dependency updates before changing the pinned version; use automated dependency and vulnerability scanning.

  6. Remove python-dotenv from requirements.txt if it is not required, or document and use it if it is genuinely needed.

  7. Run the skill and its dependencies under a least-privileged account or isolated environment to reduce the impact of a compromised package.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (12)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill documentation is written primarily in Spanish, while usage examples include English queries, and there is no statement that the skill supports multiple languages or that Spanish is a deliberate region-specific constraint. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill invokes local commands via python3 and depends on environment/configuration (OPENCLAW_NOTEBOOK_ID, Google auth, nlm) but does not declare any explicit tool scope or permissions boundary. That can lead to over-broad execution in hosts that infer capabilities loosely, making unintended shell or environment access easier if the skill is activated in the wrong context.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

Trigger phrases like help, ayuda, manual, how to, error, and no funciona are broad and not tightly scoped to OpenClaw, so the skill may activate on unrelated requests. Because this skill can lead to shell-backed execution of a local Python script, accidental activation increases the chance of unnecessary tool use, data exposure to external services, or user confusion.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: python-dotenv==1.0.0 — 2 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via ); CVE-2026-28684 (python-dotenv reads key-value pairs from a .env file and can set them as environ)

Medium
Category
Supply Chain
Confidence
96% confidence
Finding

The dependency is pinned to python-dotenv==1.0.0, and the provided advisory indicates a symlink-following/arbitrary file overwrite issue in set_key. If the skill or its surrounding tooling ever edits .env files in a workspace containing attacker-controlled symlinks, an attacker could overwrite unintended files or influence environment configuration, which can lead to configuration tampering and possible secret or execution impact.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/ask.py (reported line 20)May include surrounding context.

python
def ask(question, notebook_id=None):
    nb_id = notebook_id or DEFAULT_NOTEBOOK_ID
    try:
        result = subprocess.run(
            ["nlm", "notebook", "query", nb_id, question],
            capture_output=True,
            text=True,

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
82% confidence
Finding

The manifest describes a Q&A/manual skill for OpenClaw documentation, but this implementation shells out to the nlm executable to perform the query. Spawning subprocesses is a broader execution capability than would be expected from a documentation-answering skill and is not disclosed in the manifest description.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The script forwards the user's question and notebook ID to an external CLI/service without any in-file disclosure or consent mechanism. If users assume the query is handled locally, they may unknowingly send sensitive operational details, credentials, or internal data to a third-party system.

Content

No source excerpt is available for this finding.

Tainted flow: 'nb_id' from os.environ.get (line 18, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/ask.py (reported line 20)May include surrounding context.

python
def ask(question, notebook_id=None):
    nb_id = notebook_id or DEFAULT_NOTEBOOK_ID
    try:
        result = subprocess.run(
            ["nlm", "notebook", "query", nb_id, question],
            capture_output=True,
            text=True,

Rp1

Low
Category
MCP Rug Pull
Confidence
60% confidence
Finding

pip install without ==version installs the latest release, which could include malicious changes.

Content

No source excerpt is available for this finding.

Rp1

Low
Category
MCP Rug Pull
Confidence
79% confidence
Finding

Installing notebooklm-mcp-cli without a pinned version makes the skill's supply chain non-deterministic and exposes users to unexpected or malicious upstream changes. A compromised release or breaking update could alter behavior at install time or runtime without any change to the skill itself.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

Several user-facing strings and descriptions are hardcoded in Spanish, such as the help text and error messages, while the surrounding file metadata is partly in English. This imposes a language choice on users without opt-in or justification, which matches the locale/language policy concern.

Content

No source excerpt is available for this finding.

Rp1

Low
Category
MCP Rug Pull
Confidence
75% confidence
Finding

The file instructs users to install notebooklm-mcp-cli without pinning a version or integrity constraint. That can expose users to supply-chain risk if a compromised or breaking upstream release is installed, especially because the package is then executed as a local CLI.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.