NotebookLM Content Creation (J-Claw)

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:58 AM UTC
• Version: 2.0.0

Overview

The skill is mostly purpose-aligned, but it needs review because it can upload local files to NotebookLM and run a detached background poller without enough confirmation or containment.

Review before installing. Use it only in an environment where NotebookLM uploads are acceptable, require confirmation before any file upload, restrict report_path to an approved directory, avoid shared /tmp execution, and ensure the background poller has clear ownership, logs, and cancellation.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:88

Finding

Triggered Mode Permits Unconfirmed Upload of Caller-Selected Local Files

Content

View full analysis

"` 2. Upload source with `nlm source add --file --wait` 3. Proceed directly to Step 4 (Create Content) with the provided parameters 4. Set up polling and notify user when complete ``` ### Technical Analysis The triggered workflow treats the presence of expected message fields as sufficient authority to perform an external upload. It explicitly skips user confirmation and passes the caller-controlled `report_path` to `nlm source add`. No instruction requires the agent to: - Authenticate the upstream skill or verify the provenance of the trigger. - Confirm that the user authorized disclosure of the selected file. - Restrict the source file to an approved project or report directory. - Resolve the path and reject traversal outside an allowed root. - Reject symbolic links or special files. - Preview the resolved path and upload destination before transfer. Consequently, a crafted trigger can nominate any file readable by the account running the agent. Although the `--file` argument is represented as a quoted placeholder in the documentation, quoting only mitigates shell parsing; it does not prevent un ...[truncated 1363 chars]

Remediation

View remediation

T07 · Tool Hijacking and Spoofing

Error

• Location: SKILL.md:133

Finding

Predictable Shared Temporary Path Enables Polling Script Substitution

Content

View full analysis

__/ task.json ← full task metadata progress.json ← poll count, artifact id, last status poll.log ← each poll attempt error.log ← errors done.flag ← created on success ← downloaded artifact ``` ```bash cd /tmp/notebooklm-studio// nohup bash /tmp/notebooklm-studio/poll.sh > /dev/null 2>&1 & ``` ```bash #!/bin/bash set -euo pipefail TASK_DIR="/tmp/notebooklm-studio/" cd "$TASK_DIR" ``` ### Technical Analysis The workflow uses a predictable hierarchy under the globally shared `/tmp` directory but does not require secure directory creation, restrictive permissions, ownership checks, atomic file creation, or symbolic-link defenses. There is also a direct path inconsistency. The instructions say to write `poll.sh` to `/poll.sh`, but the launch command executes: ```bash /tmp/notebooklm-studio/poll.sh ``` This is the parent-level script rather than the script created inside the task directory. An existing, stale, or attacker-controlled parent-level file can therefore be executed instead of the generated polling script. Even if this mismatch is corrected, predictable task names based on a timestamp, notebook name, and studio type can expose task metadata and output writes to race or symlink attacks unless the hierarchy is created securely. The background process inherits the agent account's permissions and authenticated command-line environment. ### Attack Path 1. A local attacker who can write to `/tmp` anticipates use of `/tmp/notebooklm-studio`. 2. The attacker creates or replaces `/tmp/notebooklm-studio/poll.sh` with a malicious shell script. Depe ...[truncated 1599 chars]

Remediation

View remediation

"$TASK_DIR/nohup.log" 2>&1 & ``` 5. Avoid embedding a separately reconstructed task path inside the script. Pass the already validated directory as an argument or derive it from the script's own canonical location. 6. Use safe file-creation flags and reject symbolic links when writing `task.json`, `progress.json`, logs, flags, and downloaded outputs. 7. Validate and constrain the sanitized notebook-name component. Do not allow separators, traversal elements, control characters, or shell metacharacters. 8. Retain execution logs in the private task directory rather than discarding all output, and report startup failures. 9. Apply a restrictive `umask`, such as `umask 077`, before creating any task files. 10. Consider placing runtime state under a user-private runtime directory instead of globally shared `/tmp`. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:11

Finding

Unpinned Third-Party CLI Installation Creates a Mutable Supply-Chain Boundary

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script claims multi-type support but always runs nlm download audio and sends podcast-specific notices, regardless of the requested artifact type. This can cause incorrect downloads, failed handling, misleading status reporting, and unsafe assumptions about output files and downstream automation.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

md

- **Download existing**: go directly to download step
- **Generate new**: proceed to Step 3

### Step 3 — Pre-Flight Confirmation OR Auto-Execute

**Interactive mode (user initiated):** Ask all parameters at once. Write in the user's current session language.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 94% confidence

Finding

The explicit 'auto-execute' behavior creates a pathway for upstream-triggered actions to occur without direct user review. Given that the skill can create notebooks, upload files, and contact external services, this increases the chance of unintended or abusive operations.

Content

Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.

Reply with any changes, or "ok" to proceed with defaults.

text

**Triggered mode (upstream skill chaining):** When the agent receives a trigger message containing all required parameters (e.g., from Deep Research), **skip user confirmation** and auto-execute. The trigger message should include:
- `报告路径` / `report_path`: path to the source file to upload
- `Notebook 名称` / `notebook_name`: name for the notebook (create if not exists)
- `产出类型`: Audio Overview / Video Overview / Infographics / Slides

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 94% confidence

Finding

The explicit 'auto-execute' behavior creates a pathway for upstream-triggered actions to occur without direct user review. Given that the skill can create notebooks, upload files, and contact external services, this increases the chance of unintended or abusive operations.

Content

Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.

Reply with any changes, or "ok" to proceed with defaults.

text

**Triggered mode (upstream skill chaining):** When the agent receives a trigger message containing all required parameters (e.g., from Deep Research), **skip user confirmation** and auto-execute. The trigger message should include:
- `报告路径` / `report_path`: path to the source file to upload
- `Notebook 名称` / `notebook_name`: name for the notebook (create if not exists)
- `产出类型`: Audio Overview / Video Overview / Infographics / Slides

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The triggered mode materially expands the skill's scope from generating content from an existing notebook into creating notebooks and uploading source material automatically. That broadens data-handling behavior and can cause unintended exfiltration or processing of local files without an explicit user check at execution time.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Triggered mode allows automatic creation, upload, and generation actions with no user-facing warning at the moment of execution. In context, the skill can process local files and remote services, so skipping confirmation makes accidental disclosure or unintended cloud upload substantially more likely.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 87% confidence

Finding

Using nohup to spawn a detached background poller creates session-persistent behavior outside the normal request lifecycle. Persistent tasks are harder to supervise, can continue operating after user context changes, and can keep polling services and sending outbound notifications without active oversight.

Content

Scanner excerpt · SKILL.md (reported line 164)May include surrounding context.

Launch the polling script in the background:

bash

cd /tmp/notebooklm-studio/<task-dir>/
nohup bash /tmp/notebooklm-studio/poll.sh > /dev/null 2>&1 &

Step 7 — Polling Script

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The background script introduces an outbound messaging capability through openclaw to Discord, which is outside the core NotebookLM content-creation purpose. Any extra network egress path increases the chance of data leakage, misuse of chat identifiers, or covert notification behavior independent of the main agent flow.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Several notification messages in the script are fixed in Chinese, while the surrounding instructions elsewhere say to write in the current session language. This creates a locale policy violation because users may receive forced Chinese notifications without opt-in or language selection.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The user-facing message says 'Poll every 5 minutes, max 40 minutes,' but the configured values are INTERVAL=300 and MAX_POLLS=8, which yields up to roughly 40 minutes, while later 'Lessons Learned' says '40 times × 1 minute = 40 minutes.' These contradictory operational claims make the documented intent inconsistent with the actual script behavior.

Content

No source excerpt is available for this finding.