notebooklm-py-skill

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:47 AM UTC
• Version: 1.0.1

Overview

This is a disclosed NotebookLM CLI helper; the main caution is that it asks users to install and use a third-party CLI with their NotebookLM account.

Before installing, consider pinning notebooklm-py to a trusted reviewed version and use pipx rather than a global pip install. Only use this skill with notebooks and files you intend to expose to NotebookLM, and review any delete, clean, share, generate, or download action before approving it.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:23

Finding

Unpinned Third-Party CLI Dependency

Content

View full analysis

Vulnerability Details

File Location: README.md:23
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

Vulnerable Code

bash

pipx install notebooklm-py

Related guidance also appears at references/notebooklm-py-cli.md:5:

text

- Install CLI with `pipx install notebooklm-py` or `pip install notebooklm-py`.

Technical Analysis

The installation instructions retrieve the latest available notebooklm-py package from the configured Python package index without pinning an exact version, validating a cryptographic hash, or using a lockfile. Although the dependency is directly related to the Skill’s declared functionality and the reference states that behavior was verified against version 0.5.0, the installation commands do not enforce that reviewed version.

Python package installation and subsequent CLI execution can run third-party code with the privileges of the invoking user. Consequently, the effective dependency may change after this Skill has been reviewed. A compromised publisher account, malicious future release, package-index compromise, or unsafe custom package-index configuration could cause users to install code that was not covered by this audit.

Attack Path

1. An attacker compromises the package publisher, distribution channel, or a package index selected by the user’s Python configuration.
2. The attacker publishes a malicious or backdoored notebooklm-py release.
3. A user follows the documented unpinned pipx install notebooklm-py or pip install notebooklm-py command.
4. The package manager retrieves and installs the attacker-controlled release.
5. Installation hooks or later execution of the notebooklm CLI runs attacker-controlled code under the user’s account.
6. The malicious code may access files available to that account, NotebookLM authentication state, data submitted through the CLI, or resources reachable through the authenticated session.

Impact Assessment

Succe ...[truncated 500 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to an explicitly reviewed version, for example:

   bash

   pipx install "notebooklm-py==0.5.0"
   

2. Verify the selected release remains compatible with the documented commands before publication.

3. Provide expected SHA-256 hashes for approved distribution artifacts and document a hash-verification workflow.

4. Use a reproducible lockfile or constraints file where the installation environment permits it.

5. Document the canonical package publisher and source repository so users can verify package provenance.

6. Avoid recommending unrestricted pip install when an isolated pipx installation is sufficient.

7. Establish an update process that reviews new dependency releases before changing the pinned version.

8. Apply the same pinned and verified installation guidance consistently in both README.md and references/notebooklm-py-cli.md.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.