Anything To Notebooklm

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:32 AM UTC
• Version: 1.0.0

Overview

The skill has a coherent NotebookLM workflow, but installation pulls and runs unpinned third-party code and adds persistent agent integration for broad content uploads.

Install only if you are comfortable running unpinned third-party GitHub code, adding a persistent MCP server to Claude configuration, and uploading selected or extracted content to Google NotebookLM. Review the MCP server source and dependency revisions first, use a virtual environment, avoid sensitive/private files unless you intend to upload them, and do not run the /tmp permission troubleshooting command.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: install.sh:42

Finding

Unpinned Remote Dependencies Permit Mutable Third-Party Code Execution

Content

View full analysis

/dev/null; then NOTEBOOKLM_VERSION=$(notebooklm --version 2>/dev/null || echo "unknown") echo -e "${GREEN}✅ NotebookLM CLI 已安装 ($NOTEBOOKLM_VERSION)${NC}" else echo "正在安装 notebooklm-py..." pip3 install git+https://github.com/teng-lin/notebooklm-py.git -q if command -v notebooklm &> /dev/null; then echo -e "${GREEN}✅ NotebookLM CLI 安装完成${NC}" else echo -e "${RED}❌ NotebookLM CLI 安装失败${NC}" echo "请手动安装：pip3 install git+https://github.com/teng-lin/notebooklm-py.git" exit 1 fi fi ``` ```text fastmcp>=0.1.0 playwright>=1.40.0 beautifulsoup4>=4.12.0 lxml>=4.9.0 # File format conversion markitdown[all]>=0.0.1 ``` ### Technical Analysis The installer clones the default branch of `Bwkyd/wexin-read-mcp` without selecting or verifying a reviewed commit. It subsequently installs dependencies from the cloned repository's `requirements.txt`, which is also mutable and outside the audited project. The NotebookLM CLI is installed directly from ...[truncated 2417 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:572

Finding

Troubleshooting Guidance Can Apply Unsafe Permissions to the System Temporary Directory

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (34)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The README explains that content is automatically uploaded to NotebookLM as part of the workflow, but it does not present this as a prominent privacy/security warning near the skill description. Users may provide private local files, scanned documents, transcripts, or scraped content without understanding that the material leaves the local environment and is transferred to a third-party service.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

If the broader analyzer is correct that packaging, temp-directory creation, and file-copying are part of the skill behavior, that would materially differ from the advertised NotebookLM content workflow. Even if not directly malicious, this mismatch can hide file collection or redistribution behavior behind an unrelated description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

If the broader analyzer is correct that packaging, temp-directory creation, and file-copying are part of the skill behavior, that would materially differ from the advertised NotebookLM content workflow. Even if not directly malicious, this mismatch can hide file collection or redistribution behavior behind an unrelated description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

If the broader analyzer is correct that packaging, temp-directory creation, and file-copying are part of the skill behavior, that would materially differ from the advertised NotebookLM content workflow. Even if not directly malicious, this mismatch can hide file collection or redistribution behavior behind an unrelated description.

Content

No source excerpt is available for this finding.

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 96% confidence

Finding

The skill instructs editing ~/.claude/config.json, a sensitive agent configuration file that governs tool integrations and trusted execution pathways. Directing users or agents toward this path increases the risk of persistent configuration changes, unauthorized tool registration, or future code execution through the modified config.

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

配置 MCP（需要手动添加到 Claude 配置文件）：

macOS: 编辑 ~/.claude/config.json

json

{

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 96% confidence

Finding

A repeated instruction to edit ~/.claude/config.json reinforces persistent modification of a privileged configuration surface. Because this file controls future agent behavior, changes here can have lasting effects beyond the immediate task and may enable unexpected local code execution via registered services.

Content

Scanner excerpt · SKILL.md (reported line 525)May include surrounding context.

⚠️ 第一次使用前必须配置

编辑 ~/.claude/config.json：

json

{

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 577)May include surrounding context.

chmod 755 /tmp

测试写入

touch /tmp/test.txt && rm /tmp/test.txt

text

### 4. 生成任务卡住

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · check_env.py (reported line 211)May include surrounding context.

python

if passed < total:
        print("💡 修复建议：")
        print("  1. 运行安装脚本：./install.sh")
        print("  2. 配置 MCP：编辑 ~/.claude/config.json")
        print("  3. 认证 NotebookLM：notebooklm login")
        print()

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

The installer references the Claude agent configuration path and instructs the user to add an MCP server entry that points to code cloned during installation. Although it does not directly modify the file, it is explicitly guiding persistent agent configuration changes that would grant ongoing execution access to the third-party server in future sessions.

Content

Scanner excerpt · install.sh (reported line 110)May include surrounding context.

sh

echo -e "${YELLOW}[6/6] 配置指导${NC}"
echo ""

CLAUDE_CONFIG="$HOME/.claude/config.json"
CONFIG_SNIPPET="    \"weixin-reader\": {
      \"command\": \"python\",
      \"args\": [

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README markets the skill as handling 'any content' via natural language, which encourages invocation from very broad prompts without clear scope boundaries. In an agent setting, overly broad trigger language can cause accidental activation on unrelated user requests, leading to unintended fetching, processing, or upload of data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README advertises automatic fetching, OCR, transcription, ZIP processing, and file generation while omitting explicit privacy, copyright, and local data handling safeguards. Because the skill processes many sensitive input types and may extract content from archives, scans, and remote pages, the lack of warnings and consent checkpoints increases the risk of accidental disclosure or over-collection.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The example phrases are common, conversational requests like '生成播客' or '做成PPT' without mandatory qualifiers about sources, destinations, or consent. In practice this lowers the threshold for accidental execution and can make the agent interpret ordinary discussion as authorization to retrieve content and send it to third-party services.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill describes extensive use of local files and shell commands, but it declares no explicit tool scope or allowed-tools restrictions. That increases the chance an agent executing the skill will invoke broader file and shell capabilities than users expect, especially given the many local-path, temp-file, and command examples embedded in the document.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest description and all invocation examples are presented only in Chinese, and the skill does not state that other languages are supported or that Chinese is an optional/default locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern unless clearly justified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill processes local files, fetched pages, transcripts, OCR text, metadata, and search results, then uploads them to NotebookLM, but it does not prominently warn that this data leaves the local environment. Users may unknowingly disclose sensitive documents, embedded metadata, or private research queries to an external service.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly promotes using an MCP server to bypass WeChat anti-scraping protections. That introduces legal/compliance risk and encourages deployment of extra code with elevated trust, expanding the attack surface beyond ordinary content ingestion.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Automatic ZIP extraction and processing can expand the data scope far beyond what a user expects from providing a single archive. It may ingest multiple documents, nested files, or unintended sensitive material and then upload the extracted content externally.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill asks users to modify the Claude configuration to register a local Python MCP server. That is a broader and more persistent capability than the described one-off document workflow, because it enables future agent-mediated execution of local code through the configured server.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 574)May include surrounding context.

bash

# 确保临时目录可写
chmod 755 /tmp

# 测试写入
touch /tmp/test.txt && rm /tmp/test.txt

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code file contains user-facing natural language entirely in Chinese, including the top-level script description and all status/output strings, with no indication that language choice is configurable or that the skill is intended only for Chinese-speaking users. That creates a locale-policy concern because the skill appears to impose a specific language on all users without opt-in.

Content

No source excerpt is available for this finding.

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution
• Confidence: 75% confidence

Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · check_env.py (reported line 47)May include surrounding context.

python

import_name = module_name

    try:
        __import__(import_name)
        print_status("ok", f"{module_name} 已安装")
        return True
    except ImportError:

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · check_env.py (reported line 62)May include surrounding context.

python

# 尝试获取版本
        import subprocess
        try:
            result = subprocess.run([cmd, "--version"],
                                  capture_output=True,
                                  text=True,
                                  timeout=5)

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · check_env.py (reported line 114)May include surrounding context.

python

import subprocess

    try:
        result = subprocess.run(["notebooklm", "list"],
                              capture_output=True,
                              text=True,
                              timeout=10)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Most prompts, status messages, and usage examples in the installer are presented only in Chinese, including operational guidance the user must follow. This imposes a specific language on all users without opt-in or justification, which matches the language/locale policy violation category.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The installer fetches and installs an additional third-party repository (wexin-read-mcp) directly from GitHub as part of setup, expanding the trust boundary beyond the declared skill code. This creates a supply-chain risk because arbitrary code from that repository and its requirements can execute during install, and the added MCP server also gains follow-on integration into the agent workflow.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.