NotebookLM Content Creation (J-Claw)

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:58 AM UTC
• Version: 2.0.0

Overview

The skill is mostly purpose-aligned, but it needs review because it can upload local files to NotebookLM and run a detached background poller without enough confirmation or containment.

Review before installing. Use it only in an environment where NotebookLM uploads are acceptable, require confirmation before any file upload, restrict report_path to an approved directory, avoid shared /tmp execution, and ensure the background poller has clear ownership, logs, and cancellation.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:88
• Finding: Triggered Mode Permits Unconfirmed Upload of Caller-Selected Local Files<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 88–99 **Vulnerability Type**: Unauthenticated local-file upload and missing authorization validation **Risk Level**: High ### Vulnerable Code ```markdown **Triggered mode (upstream skill chaining):** When the agent receives a trigger message containing all required parameters (e.g., from Deep Research), **skip user confirmation** and auto-execute. The trigger message should include: - `报告路径` / `report_path`: path to the source file to upload - `Notebook 名称` / `notebook_name`: name for the notebook (create if not exists) - `产出类型`: Audio Overview / Video Overview / Infographics / Slides - `格式`: deep_dive / brief / etc. - `长度`: short / default / long - `语言`: BCP-47 code In triggered mode, the agent should: 1. Create notebook with `nlm notebook create "<notebook_name>"` 2. Upload source with `nlm source add <notebook_id> --file <report_path> --wait` 3. Proceed directly to Step 4 (Create Content) with the provided parameters 4. Set up polling and notify user when complete ``` ### Technical Analysis The triggered workflow treats the presence of expected message fields as sufficient authority to perform an external upload. It explicitly skips user confirmation and passes the caller-controlled `report_path` to `nlm source add`. No instruction requires the agent to: - Authenticate the upstream skill or verify the provenance of the trigger. - Confirm that the user authorized disclosure of the selected file. - Restrict the source file to an approved project or report directory. - Resolve the path and reject traversal outside an allowed root. - Reject symbolic links or special files. - Preview the resolved path and upload destination before transfer. Consequently, a crafted trigger can nominate any file readable by the account running the agent. Although the `--file` argument is represented as a quoted placeholder in the documentation, quoting only mitigates shell parsing; it does not prevent un ...[truncated 1363 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require explicit user confirmation before every external file upload, including workflows initiated by another skill. 2. Authenticate upstream invocations using trusted metadata or a capability token rather than relying on the presence of expected fields. 3. Resolve the requested file with a canonical-path operation and require it to remain under a narrowly approved source directory. 4. Reject symbolic links, device files, sockets, directories, and other non-regular files. 5. Present the canonical local path, file size, notebook destination, and external service to the user before transfer. 6. Maintain a separate allowlist of artifacts produced by trusted upstream workflows and pass opaque artifact identifiers instead of arbitrary filesystem paths. 7. Apply file-size and extension restrictions and scan content for secrets before upload. 8. Log the validated caller identity, user approval, canonical source path, destination notebook, and upload result without recording sensitive file contents. ]]>

T07 · Tool Hijacking and Spoofing

Error

• Location: SKILL.md:133
• Finding: Predictable Shared Temporary Path Enables Polling Script Substitution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 133–175 **Vulnerability Type**: Unsafe temporary-file handling and background script path mismatch **Risk Level**: High ### Vulnerable Code ```markdown /tmp/notebooklm-studio/ <YYMMDD-HHmm>_<sanitized-notebook-name>_<studio-type>/ task.json ← full task metadata progress.json ← poll count, artifact id, last status poll.log ← each poll attempt error.log ← errors done.flag ← created on success <output file> ← downloaded artifact ``` ```bash cd /tmp/notebooklm-studio/<task-dir>/ nohup bash /tmp/notebooklm-studio/poll.sh > /dev/null 2>&1 & ``` ```bash #!/bin/bash set -euo pipefail TASK_DIR="/tmp/notebooklm-studio/<task-dir>" cd "$TASK_DIR" ``` ### Technical Analysis The workflow uses a predictable hierarchy under the globally shared `/tmp` directory but does not require secure directory creation, restrictive permissions, ownership checks, atomic file creation, or symbolic-link defenses. There is also a direct path inconsistency. The instructions say to write `poll.sh` to `<task-dir>/poll.sh`, but the launch command executes: ```bash /tmp/notebooklm-studio/poll.sh ``` This is the parent-level script rather than the script created inside the task directory. An existing, stale, or attacker-controlled parent-level file can therefore be executed instead of the generated polling script. Even if this mismatch is corrected, predictable task names based on a timestamp, notebook name, and studio type can expose task metadata and output writes to race or symlink attacks unless the hierarchy is created securely. The background process inherits the agent account's permissions and authenticated command-line environment. ### Attack Path 1. A local attacker who can write to `/tmp` anticipates use of `/tmp/notebooklm-studio`. 2. The attacker creates or replaces `/tmp/notebooklm-studio/poll.sh` with a malicious shell script. Depe ...[truncated 1599 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Create the task directory with `mktemp -d` under a private base directory and set permissions to `0700`. 2. Ensure the base directory is owned by the current account and is neither writable by other users nor a symbolic link. 3. Write the polling script atomically with mode `0700` and verify it is a regular file owned by the expected user. 4. Execute the exact generated script path: ```bash nohup bash "$TASK_DIR/poll.sh" >"$TASK_DIR/nohup.log" 2>&1 & ``` 5. Avoid embedding a separately reconstructed task path inside the script. Pass the already validated directory as an argument or derive it from the script's own canonical location. 6. Use safe file-creation flags and reject symbolic links when writing `task.json`, `progress.json`, logs, flags, and downloaded outputs. 7. Validate and constrain the sanitized notebook-name component. Do not allow separators, traversal elements, control characters, or shell metacharacters. 8. Retain execution logs in the private task directory rather than discarding all output, and report startup failures. 9. Apply a restrictive `umask`, such as `umask 077`, before creating any task files. 10. Consider placing runtime state under a user-private runtime directory instead of globally shared `/tmp`. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:11
• Finding: Unpinned Third-Party CLI Installation Creates a Mutable Supply-Chain Boundary<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 11 **Vulnerability Type**: Unpinned third-party dependency installation without integrity verification **Risk Level**: Medium ### Vulnerable Code ```markdown - `notebooklm-mcp-cli` installed: `uv tool install notebooklm-mcp-cli` ``` ### Technical Analysis The installation command does not specify a reviewed version, artifact hash, signature, locked dependency set, or trusted package index. It therefore resolves the package and its transitive dependencies according to mutable repository state at installation time. This means the effective executable code can change after the skill itself has been audited. A compromised maintainer account, malicious package release, repository compromise, or compromised transitive dependency could introduce hostile behavior without any modification to `SKILL.md`. The finding is a supply-chain weakness rather than proof that the named package is currently malicious. ### Attack Path 1. An attacker compromises the package publisher, distribution repository, or one of the package's transitive dependencies. 2. The attacker publishes a malicious version that still resolves under the unversioned package name. 3. An operator follows the documented command: `uv tool install notebooklm-mcp-cli`. 4. The package manager retrieves the current mutable release and associated dependencies. 5. Malicious code executes during installation or when the `nlm` command is subsequently invoked. 6. The code operates with the privileges and accessible authentication context of the installing or invoking account. ### Impact Assessment Impact is bounded by the privileges of the account performing installation or invoking the installed CLI. Potential scope includes arbitrary same-user code execution, access to files readable by that account, compromise of NotebookLM authentication state, alteration of generated artifacts, and unauthorized network activity. If an administrator ...[truncated 255 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `notebooklm-mcp-cli` to a specific reviewed version rather than installing the latest available release. 2. Use a lock file or equivalent mechanism to pin all transitive dependencies. 3. Verify package hashes or publisher signatures against trusted release metadata. 4. Explicitly configure and document the approved package index. 5. Review the package's official provenance and release process before deployment. 6. Install the tool in an isolated, least-privileged environment dedicated to the workflow. 7. Test upgrades separately and update the approved version only after security review. 8. Where supported, generate and retain a software bill of materials for the resolved dependency set. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Intent-Code Divergence

High

• Confidence: 97% confidence
• Finding: The script claims multi-type support but always runs `nlm download audio` and sends podcast-specific notices, regardless of the requested artifact type. This can cause incorrect downloads, failed handling, misleading status reporting, and unsafe assumptions about output files and downstream automation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- **Download existing**: go directly to download step
- **Generate new**: proceed to Step 3

### Step 3 — Pre-Flight Confirmation OR Auto-Execute

**Interactive mode (user initiated):** Ask all parameters at once. Write in the user's current session language.

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

Reply with any changes, or "ok" to proceed with defaults.
```

**Triggered mode (upstream skill chaining):** When the agent receives a trigger message containing all required parameters (e.g., from Deep Research), **skip user confirmation** and auto-execute. The trigger message should include:
- `报告路径` / `report_path`: path to the source file to upload
- `Notebook 名称` / `notebook_name`: name for the notebook (create if not exists)
- `产出类型`: Audio Overview / Video Overview / Infographics / Slides

• Confidence: 94% confidence
• Finding: The explicit 'auto-execute' behavior creates a pathway for upstream-triggered actions to occur without direct user review. Given that the skill can create notebooks, upload files, and contact external services, this increases the chance of unintended or abusive operations.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

Reply with any changes, or "ok" to proceed with defaults.
```

**Triggered mode (upstream skill chaining):** When the agent receives a trigger message containing all required parameters (e.g., from Deep Research), **skip user confirmation** and auto-execute. The trigger message should include:
- `报告路径` / `report_path`: path to the source file to upload
- `Notebook 名称` / `notebook_name`: name for the notebook (create if not exists)
- `产出类型`: Audio Overview / Video Overview / Infographics / Slides

• Confidence: 94% confidence
• Finding: The explicit 'auto-execute' behavior creates a pathway for upstream-triggered actions to occur without direct user review. Given that the skill can create notebooks, upload files, and contact external services, this increases the chance of unintended or abusive operations.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The triggered mode materially expands the skill's scope from generating content from an existing notebook into creating notebooks and uploading source material automatically. That broadens data-handling behavior and can cause unintended exfiltration or processing of local files without an explicit user check at execution time.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Triggered mode allows automatic creation, upload, and generation actions with no user-facing warning at the moment of execution. In context, the skill can process local files and remote services, so skipping confirmation makes accidental disclosure or unintended cloud upload substantially more likely.

Session Persistence

Medium

• Category: Rogue Agent

Content

Launch the polling script in the background:
```bash
cd /tmp/notebooklm-studio/<task-dir>/
nohup bash /tmp/notebooklm-studio/poll.sh > /dev/null 2>&1 &
```

### Step 7 — Polling Script

• Confidence: 87% confidence
• Finding: Using `nohup` to spawn a detached background poller creates session-persistent behavior outside the normal request lifecycle. Persistent tasks are harder to supervise, can continue operating after user context changes, and can keep polling services and sending outbound notifications without active oversight.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The background script introduces an outbound messaging capability through openclaw to Discord, which is outside the core NotebookLM content-creation purpose. Any extra network egress path increases the chance of data leakage, misuse of chat identifiers, or covert notification behavior independent of the main agent flow.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: Several notification messages in the script are fixed in Chinese, while the surrounding instructions elsewhere say to write in the current session language. This creates a locale policy violation because users may receive forced Chinese notifications without opt-in or language selection.

Intent-Code Divergence

Low

• Confidence: 95% confidence
• Finding: The user-facing message says 'Poll every 5 minutes, max 40 minutes,' but the configured values are `INTERVAL=300` and `MAX_POLLS=8`, which yields up to roughly 40 minutes, while later 'Lessons Learned' says '40 times × 1 minute = 40 minutes.' These contradictory operational claims make the documented intent inconsistent with the actual script behavior.

Static analysis

No suspicious patterns detected.