NotebookLM

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:53 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a coherent NotebookLM helper, but it uses an unpinned npm authentication command and encourages rotating Google accounts after quota limits.

Install only if you trust the NotebookLM MCP package publisher and are comfortable giving the tool access to your authenticated Google NotebookLM session. Pin or locally install the npm package before running auth, verify `NOTEBOOKLM_SERVER_URL` before sending questions, avoid account rotation to bypass quotas unless it is allowed by your account policy, and choose a safe dedicated vault directory for batch exports.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: scripts/nblm.sh:18

Finding

Unpinned Third-Party Package Execution During Google Authentication

Content

View full analysis

Vulnerability Details

File Location: scripts/nblm.sh, lines 18 and 51
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Vulnerable Code:

bash

PKG="@roomi-fields/notebooklm-mcp"

bash

auth)
  # One-time interactive Google login (opens a visible Chrome window).
  exec npx -y -p "$PKG" notebooklm-mcp-setup-auth "$@"
  ;;

Technical Analysis

The auth command invokes npx -y with an npm package name that has no exact version constraint. Consequently, npm may retrieve and execute whichever package version the registry resolves at invocation time. The project provides neither a committed lockfile nor an integrity constraint for this executable.

The -y option suppresses the normal installation confirmation, and exec replaces the wrapper process with package-controlled code. This creates a supply-chain trust boundary in which the code executed by an audited Skill can change after the audit without any corresponding modification to the Skill repository.

This operation is especially sensitive because the package is launched as part of a Google authentication workflow and opens an interactive browser. If a package release, maintainer account, registry response, or transitive dependency were compromised, malicious code could run with the privileges of the user invoking the Skill.

There is no evidence in the audited files that the current npm package is malicious. The confirmed issue is the unsafe, unpinned remote dependency execution mechanism.

Attack Path

1. An attacker compromises the npm package, its publisher account, the package distribution channel, or a transitive dependency.
2. The attacker publishes a malicious version that still exposes the expected notebooklm-mcp-setup-auth executable.
3. A user or AI Agent runs scripts/nblm.sh auth.
4. npx -y -p "@roomi-fields/notebooklm-mcp" resolves and downloads the remotely supplied pac ...[truncated 857 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin @roomi-fields/notebooklm-mcp to an exact, reviewed version rather than relying on the registry's current resolution.
2. Declare the dependency in a project manifest and commit the corresponding lockfile.
3. Install dependencies in a controlled setup step using lockfile-enforcing commands such as npm ci.
4. Invoke the locally installed binary from node_modules/.bin instead of downloading and executing it through npx -y during authentication.
5. Preserve and verify registry integrity metadata, and review both direct and transitive dependency changes before upgrades.
6. Remove automatic confirmation suppression so unexpected package installation cannot proceed silently.
7. Run the authentication utility with the minimum required filesystem and environment access, preferably in an isolated execution context.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (16)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description significantly overstates the implemented behavior. The script is narrowly a REST wrapper around a running NotebookLM MCP HTTP server, plus an auth helper. It does match parts of the description: querying notebooks for grounded answers, listing notebooks, generating several Studio content types, and handling Google login. However, core declared claims are missing: automatic use of MCP tools when available, broad notebook/source/content management, source discovery, and quota-aware ingestion workflows. This is a material description-to-behavior mismatch rather than a minor implementation detail gap.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

md

2. **HTTP REST API** — otherwise, use the bundled `scripts/nblm.sh`, which talks

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

md

2. **HTTP REST API** — otherwise, use the bundled `scripts/nblm.sh`, which talks

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

md

2. **HTTP REST API** — otherwise, use the bundled `scripts/nblm.sh`, which talks

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

md

2. **HTTP REST API** — otherwise, use the bundled `scripts/nblm.sh`, which talks

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

md

2. **HTTP REST API** — otherwise, use the bundled `scripts/nblm.sh`, which talks

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

md

2. **HTTP REST API** — otherwise, use the bundled `scripts/nblm.sh`, which talks

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

md

2. **HTTP REST API** — otherwise, use the bundled `scripts/nblm.sh`, which talks

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill explicitly instructs use of shell commands and local scripts (scripts/nblm.sh, auth/setup commands), but it declares no tool scope or allowed-tools constraints. In an agent environment, that creates unnecessary privilege ambiguity: the skill may trigger shell execution without prior capability scoping, increasing the risk of unintended command execution or abuse if the skill is invoked in a broader-privileged session.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The guidance explicitly recommends multi-account rotation and automatic re-authentication to continue using the service after a quota limit is reached. That behavior can facilitate circumvention of provider-imposed usage controls and create compliance, account abuse, or policy-violation risk for users of the skill. In this skill context, the risk is elevated because the document presents the practice as a primary operational pattern rather than warning against it.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/rest-api.md (reported line 45)May include surrounding context.

md

## Content generation

| Method | Path                 | Body                              | Purpose                                                                                   |
| ------ | -------------------- | --------------------------------- | ----------------------------------------------------------------------------------------- |
| POST   | `/content/generate`  | `{ notebook_id, content_type }`   | Studio: `audio` \| `report` \| `video` \| `infographic` \| `presentation` \| `data_table` |
| POST   | `/content/study-aid` | `{ notebook_id, kind, focus? }`   | `kind`: `flashcards` \| `quiz`                                                            |

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation describes a batch export endpoint that writes answer files and JSON sidecars into a caller-supplied vault_dir, but it does not warn about local filesystem side effects, overwrite risk, or the need to constrain output paths. In an agent skill context, such omissions can lead downstream automation to write to sensitive or unintended directories if user input is passed through unchecked.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/rest-api.md (reported line 56)May include surrounding context.

md

## Batch → vault (for large research runs)

| Method | Path              | Body                                                                   | Purpose                                                                                                   |
| ------ | ----------------- | ---------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------- |
| POST   | `/batch-to-vault` | `{ questions[], vault_dir, notebook_id, source_format, slug_prefix? }` | Run many questions, write each answer as markdown + JSON sidecar (`nblm-answer-v1`) for offline retrieval |

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/nblm.sh (reported line 30)May include surrounding context.

sh

_req() { # method path [json-body]
  local method="$1" path="$2" body="${3:-}"
  if [ -n "$body" ]; then
    curl -fsS -X "$method" "$BASE$path" -H 'Content-Type: application/json' -d "$body"
  else
    curl -fsS -X "$method" "$BASE$path"
  fi

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill directs the user to authenticate a Google account and states that the session is saved and reused across runs, but it does not clearly warn that subsequent skill use may access data within that authenticated Google context. In a multi-tool or shared environment, that can lead to unintended access to private notebooks or account-scoped content without the user appreciating the persistence of the session.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This markdown file explicitly instructs the user to run a workflow that 'writes markdown + nblm-answer-v1 JSON sidecars with citations', which affects local user data storage. The description does not include a user-facing warning about where files are written, that citations/excerpts may be stored locally, or that the operation creates persistent artifacts.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.