notebooklm

ISSUES FOUND max severity HIGHSkillSpector Do not install 51 registry clawhub.ai last scanned 2026-02-06 1 scan

4 findings (3 high, 1 medium), mainly data exfiltration, unauthorized tool use, command injection. Most recent scan 2026-02-06.

This NotebookLM skill presents MODERATE to HIGH security risks primarily related to credential exposure and data exfiltration. The skill's core functionality—uploading local files to Google NotebookLM for AI analysis—inherently involves transmitting potentially sensitive business documents to an external service. Key concerns include: (1) Google account credentials stored in plaintext browser state files on disk, (2) unrestricted filesystem access allowing reading of sensitive credential files, (3) automated upload to external services without explicit per-file consent, and (4) subprocess execution with limited input validation. While the skill appears to function as described without deceptive behavior, the combination of broad file access permissions, credential storage, and external data transmission creates significant attack surface. The skill would benefit from stronger access controls, encryption of stored credentials, explicit user consent for uploads, and input validation hardening.
Scanner's overall assessment (LLM analyzer)

Findings4

Critical0

High3

Medium1

Low0

Analyzersstatic behavioral llm trigger meta

Second scanner: NVIDIA SkillSpector

VerdictDo not install 51

Score51 / 100

Issues18

CategoriesDangerous Code Execution Excessive Agency Rogue Agent

Version2.12.0 (static)

Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.

What this skill does

Use this skill to analyze your local files with Google NotebookLM's AI. Upload business documents, reports, and strategies to get source-grounded insights, risk analysis, and actionable recommendations. Perfect for business intelligence, document analysis, and decision support.

Package: 16 files, 110 KB
SKILL.md: 1168 words, 12+ sections
Code: Python (12)
Allowed tools: Bash Read Write Edit Glob Grep
License: Complete terms in LICENSE.txt

SKILL.md covers: NotebookLM Local File Analyzer · When to Use This Skill · Quick Start · Step 1: One-Time Setup · Step 2: Analyze Your Files · Core Workflows · Workflow 1: Business Document Analysis · Analyze business strategy files · Upload high-priority files to NotebookLM · Get strategic insights · Workflow 2: Financial Analysis · Find financial documents

Findings

HIGH Python scripts present but Python tool not in allowed-tools Unauthorized Tool Usestatic

Skill restricts tools to ['Bash', 'Read', 'Write', 'Edit', 'Glob', 'Grep'] but includes Python scripts

Remediation: Add 'Python' to allowed-tools or remove Python scripts

HIGH Google Account Credential Exposure via Browser State Persistence Data Exfiltrationllm

The skill persists Google authentication cookies and browser state to local disk in data/browser_state/ directory. The auth_manager.py stores session cookies in state.json and maintains a persistent browser profile. If an attacker gains access to the user's filesystem, they can extract these cookies to hijack the user's Google account session and access NotebookLM with the victim's credentials. The state.json file contains sensitive authentication tokens that provide full access to the user's Google account within the NotebookLM context.

scripts/auth_manager.py

self.browser_state_dir = self.data_dir / "browser_state"
self.state_file = self.browser_state_dir / "state.json"
self.auth_info_file = self.data_dir / "auth_info.json"

Remediation: 1. Encrypt browser state files at rest using OS keychain/credential manager. 2. Set restrictive file permissions (0600) on state.json. 3. Implement session expiration and require re-authentication periodically. 4. Add warning to users about the security implications of stored credentials. 5. Consider using OAuth tokens with limited scope instead of full browser session cookies.

HIGH Unrestricted File System Access for Document Upload Data Exfiltrationllm

The skill allows reading arbitrary files from the user's filesystem via local_analyzer.py and batch_analyzer.py without path restrictions. While the stated purpose is to analyze business documents, there are no safeguards preventing the skill from accessing sensitive files like ~/.ssh/id_rsa, ~/.aws/credentials, or other credential files. The batch_analyzer.py uses rglob() which can traverse the entire directory tree, and local_analyzer.py accepts any file path as input. Combined with the NotebookLM upload capability, this creates a data exfiltration risk where sensitive files could be uploaded to Google's servers.

scripts/local_analyzer.py

file_path = Path(args.file_path)
if not file_path.exists():
    print(f"[!] File not found: {file_path}")
    return 1

files = list(dir_path.rglob(args.pattern))

Remediation: 1. Implement path validation to restrict file access to specific directories (e.g., ~/Documents, ~/Business). 2. Blacklist sensitive directories (~/.ssh, ~/.aws, ~/.config). 3. Add explicit user confirmation before uploading files to external services. 4. Implement file size limits to prevent bulk data exfiltration. 5. Log all file access operations for audit purposes.

MEDIUM Subprocess Command Execution Without Input Validation Command Injectionllm

Multiple scripts use subprocess.run() to execute Python scripts with user-controlled arguments without proper input sanitization. In quick_query.py, the question argument is passed directly to subprocess.run() via command line arguments. While Python's subprocess with list arguments provides some protection against shell injection, the lack of input validation could allow command injection if the arguments are improperly handled or if shell=True is used elsewhere. The run.py script also executes arbitrary script names based on sys.argv without validation.

scripts/quick_query.py

cmd = [sys.executable, str(ask_script), '--question', args.question]
if args.url:
    cmd.extend(['--notebook-url', args.url])
result = subprocess.run(cmd)

Remediation: 1. Validate and sanitize all user inputs before passing to subprocess. 2. Use argument escaping/quoting for shell arguments. 3. Implement allowlist of valid script names in run.py. 4. Never use shell=True with user-controlled input. 5. Add input length limits to prevent buffer overflow attacks.

What is in the package

File	Kind	Size
`AUTHENTICATION.md`	doc	5.6 KB
`README.md`	doc	16 KB
`SKILL.md`	doc	9.3 KB
`requirements.txt`	doc	325 B
`scripts/__init__.py`	script	2.6 KB
`scripts/ask_question.py`	script	10 KB
`scripts/auth_manager.py`	script	14 KB
`scripts/batch_analyzer.py`	script	3.6 KB
`scripts/browser_session.py`	script	11 KB
`scripts/cleanup_manager.py`	script	9.5 KB
`scripts/local_analyzer.py`	script	2.2 KB
`scripts/notebook_manager.py`	script	14 KB
`scripts/quick_query.py`	script	1.1 KB
`scripts/run.py`	script	2.9 KB
`scripts/setup_environment.py`	script	7.0 KB
`scripts/setup_notebooklm.py`	script	1.9 KB

External hosts referenced

github.com notebooklm.google.com img.shields.io notebooklm.google stackoverflow.com www.anthropic.com www.python.org

Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.

Package contents recorded 2026-10-22. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.

What we checked

Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
Behavioral analyzer. Checks what the skill asks the agent to do against what its description claims it does.
Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
Trigger analyzer. Looks for instructions that fire on conditions the user did not ask for.
Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.

What we did not check

Runtime behaviour. The skill was not executed; findings come from reading its files.
Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
Content the analyzers cannot read: images, binaries, and some non-English text.
Known scanner bypass classes. See the methodology and limitations page.

Sources

Repository: https://clawhub.ai/skills/notebooklm
Raw scan result: notebooklm-scan.json
Badge for your README: ![skillscan.io](https://skillscan.io/badge/clawhub-ai-notebooklm.svg)
Request a re-scan