NotebookLM Content Creation

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:36 AM UTC
• Version: 1.0.0

Overview

The skill is purpose-aligned for NotebookLM content generation, but its background polling setup uses an unsafe predictable temp script path and detached execution that users should review before installing.

Review before installing. Use only in a trusted local environment, pin and verify the NotebookLM CLI dependency, change the temp workflow to use a private `mktemp` directory, launch the task-specific poll script path, preserve logs, and require visible status/stop controls for the background poller.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:11

Finding

Unpinned Third-Party CLI Dependency Creates a Supply-Chain Risk

Content

View full analysis

Remediation

View remediation

' ``` 2. Install from an explicitly trusted package index rather than relying on implicit repository configuration. 3. Use package hashes, signed release artifacts, or another integrity-verification mechanism where supported. 4. Record the approved version and expected artifact digest in the Skill documentation. 5. Establish a controlled update process in which new versions are reviewed and tested before changing the pin. 6. Avoid recommending installation with elevated privileges. ]]>

T07 · Tool Hijacking and Spoofing

Error

• Location: SKILL.md:126

Finding

Predictable Shared Temporary Script Path Allows Local Script Substitution

Content

View full analysis

/ nohup bash /tmp/notebooklm-studio/poll.sh > /dev/null 2>&1 & ``` The polling script itself is then documented with a predictable task directory: ```bash #!/bin/bash set -euo pipefail TASK_DIR="/tmp/notebooklm-studio/" cd "$TASK_DIR" ``` ### Technical Analysis The workflow states that `poll.sh` should be written inside the task-specific directory, but the launch command executes `/tmp/notebooklm-studio/poll.sh` from the shared parent directory. This mismatch means the intended task-local script may not be executed. The executed path is predictable and located under the globally shared `/tmp` hierarchy. The instructions do not require secure creation of the parent directory, restrictive permissions, ownership checks, regular-file validation, or symbolic-link rejection. If another local process can create or replace `/tmp/notebooklm-studio/poll.sh`, the documented `nohup bash` command will execute that substituted file. Invoking `bash` directly on the path bypasses any need for the attacker's file to be executable. The redirection of standard output and standard error to `/dev/null` also reduces immediate visibility into unexpected script behavior. ### Attack Path 1. A local attacker anticipates use of the Skill or observes the predictable `/tmp/notebooklm-studio` path. 2. Before the launch command runs, the attacker creates or replaces: ```text /tmp/notebooklm-studio/poll.sh ``` Alternatively, the attacker may exploit unsafe ownership or symbolic-link handling when the directory is created. 3. The agent follows the documented command: ```bash nohup bash /tmp/notebooklm-studio/poll.sh > /dev/null 2>&1 & ``` 4. Bash interprets the attacker's script under the identity of ...[truncated 940 chars]

Remediation

View remediation

"$TASK_DIR/nohup.log" 2>&1 & ``` 3. Before execution, verify that the directory and script are owned by the current user and are not symbolic links: ```bash test -O "$TASK_DIR" test -O "$TASK_DIR/poll.sh" test -f "$TASK_DIR/poll.sh" test ! -L "$TASK_DIR/poll.sh" ``` 4. Write the script to a temporary file in the private directory and rename it atomically after its contents are complete. 5. Apply restrictive permissions such as `0700` to the directory and `0600` or `0700` to the script. 6. Do not use a shared parent-level `poll.sh`; use a unique script per task. 7. Preserve background-process diagnostics in a protected log rather than discarding all output to `/dev/null`. 8. Pass the generated task directory to the script safely instead of embedding an independently constructed predictable path. ]]>

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest and surrounding documentation state that the skill creates and monitors Audio Overview, Video Overview, Infographics, and Slides. However, the actual polling script hard-codes nlm download audio, so completed non-audio artifacts would be handled incorrectly instead of being downloaded according to their type.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill directs the agent to create directories and files under /tmp and a user output path without an explicit up-front warning that filesystem state will be modified. In agent environments, silent writes can surprise users, overwrite expected locations, or leave sensitive generated content in predictable temporary paths, especially when paths incorporate notebook names and background artifacts are retained.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

Using nohup ... & launches a detached background process that persists beyond the interactive session, reducing user visibility and control over ongoing actions. In this skill, that persistent process continues polling, writing logs, and eventually downloading content to disk, which can lead to unmonitored resource consumption, unintended filesystem changes, and difficulty stopping or auditing behavior.

Content

Scanner excerpt · SKILL.md (reported line 126)May include surrounding context.

Launch the polling script in the background:

bash

cd /tmp/notebooklm-studio/<task-dir>/
nohup bash /tmp/notebooklm-studio/poll.sh > /dev/null 2>&1 &

Step 7 — Polling Script

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The completion section says that on success the skill should verify, save, and notify for arbitrary [Content type] outputs. That intent is contradicted by the only concrete implementation shown in the polling script, which always executes nlm download audio regardless of whether the artifact was video, infographic, or slides.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.