Security audit

NotebookLM

Security checks across malware telemetry and agentic risk

Overview

The skill is a coherent NotebookLM integration, but it gives agents broad notebook, account-session, sharing, and local-write capabilities without enough user-control warnings.

Install only if you are comfortable letting an agent use your NotebookLM-backed Google session, manage notebook content, and call a local NotebookLM MCP server. Before using public sharing, source import, or batch-to-vault exports, require explicit confirmation, choose a safe output directory, and avoid using multi-account rotation to bypass provider limits.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill instructs the agent to use shell-accessible commands such as `scripts/nblm.sh` and `notebooklm-mcp-setup-auth`, but the metadata does not declare corresponding permissions or execution requirements. This creates a capability/consent gap: an agent or user may invoke local commands, open browser-based auth flows, or contact local services without explicit permission signaling, which is a real security and trust issue even though the commands appear related to the skill’s stated purpose.

Missing User Warnings

Medium

Confidence: 85% confidence
Finding: The skill recommends a batch-to-cache workflow that writes markdown and `nblm-answer-v1` JSON sidecar files locally, but it does not clearly warn the user that notebook-derived content and citations will be persisted on disk. Because NotebookLM content may include sensitive research material, this can silently expand data exposure through local retention, backup systems, sync tools, or later access by other processes/users.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The document explicitly recommends multi-account rotation to bypass NotebookLM's daily query limits, which encourages circumvention of provider-imposed quotas and may violate platform terms or account policies. In an automation skill, this guidance can operationalize abusive usage patterns at scale and expose users to account suspension, compliance issues, and reputational risk.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The documented `/batch-to-vault` endpoint writes output to a caller-specified `vault_dir`, which creates a real filesystem side effect. In an agent setting, if the skill does not require explicit user confirmation or constrain allowed paths, an LLM-driven workflow could write files into unintended locations, overwrite user content, or exfiltration-staging directories. Because this skill is specifically designed to automate research/export operations, the risk is more significant than in a purely informational reference.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The `/notebooks/:id/share` endpoint can change notebook visibility via `{ public }`, but the reference does not warn that this may expose private notebook contents through a public link. In an agentic environment, a model could invoke this operation while trying to help with collaboration or troubleshooting, unintentionally turning sensitive research material public. Given the skill's purpose of handling user notebooks and sources, this context increases the sensitivity of accidental sharing.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.