📦

Audit History

notebooklm - 6 audits

Version comparison

Capability and finding changes across audited versions, newest first.

Version	Date	Result	Review items	Change vs previous
v6 Latest	Aug 4, 2026, 04:14 PM	4 confirmed	9	No capability change
v5	Jul 9, 2026, 04:55 PM	4 confirmed	8	No capability change
v4	Jul 9, 2026, 04:55 PM	4 confirmed	8	No capability change
v3	Jul 7, 2026, 01:31 AM	4 confirmed	24	Contains scripts
v2	Jun 30, 2026, 04:56 PM	3 confirmed	2	Contains scripts
v1	Feb 24, 2026, 04:47 PM	1 confirmed	4	Baseline

Audit version 6 Latest

Aug 4, 2026, 04:14 PM

The skill performs legitimate NotebookLM research automation, and most static matches are documentation or fixed commands. Confirmed risks include behavior-steering prompt injection, anti-detection automation, persistent Google session cookies, unsafe URL navigation with a disabled browser sandbox, automatic installers, and an arbitrary local Python execution path.

Files scanned

4,212

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (4)

High

README.md:200

System reconnaissance

Uses realistic typing speeds and interaction patterns to avoid detection.

The documentation explicitly says human-like interaction is used to avoid detection. This confirms deliberate evasion of Google's automation controls, not ordinary system reconnaissance.

High

scripts/ask_question.py:29-36 SKILL.md:131-144

Prompt Injection Attempt Detected

The script appends "EXTREMELY IMPORTANT: Is that ALL you need to know?" and instructions to review the user request and ask again. This tool-output text directs the host agent's behavior and can force extra external queries before the user receives a response.

The behavior-steering text is defined in code, appended to every retrieved answer, and reinforced by explicit agent instructions in SKILL.md.

High

scripts/auth_manager.py:173-179 scripts/browser_utils.py:46-53

Persistent Google Session Credentials

The skill saves complete browser storage state and later reinjects its cookies into a persistent Chrome context. Theft or unintended disclosure of this local state can enable Google session hijacking.

The code explicitly serializes browser cookies and local storage, applies restrictive permissions, and reloads the cookies for later authenticated sessions.

High

scripts/config.py:60-66 scripts/ask_question.py:74-80 scripts/notebook_manager.py:314-319

Unvalidated Browser Navigation Without Sandbox

A user-provided or library-stored URL is opened before its host is validated, while Chrome is launched with --no-sandbox. This permits arbitrary browser navigation and increases the impact of malicious web content.

The CLI accepts any URL, stores it without origin validation, navigates to it, and only afterward waits for the NotebookLM origin while the browser sandbox is disabled.

Capability review items (9)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

scripts/__init__.py:53 scripts/__init__.py:65 scripts/setup_environment.py:54 scripts/setup_environment.py:75

Python subprocess.run · 4 occurrences

subprocess.run(

Importing the scripts package can invoke pip automatically to download and execute dependencies. Network package installation as an import side effect creates supply-chain and unexpected-execution risk.

High

scripts/setup_environment.py:62

Python subprocess.run

result = subprocess.run(

First-run setup automatically installs third-party requirements from the network. Version pins reduce drift but do not remove package-index or supply-chain execution risk.

High

scripts/setup_environment.py:132

Python subprocess.run

result = subprocess.run(cmd)

The --run value is joined into a script path without an allowlist or resolved-path containment check, then executed by Python. A traversal value can execute an arbitrary existing local Python file.

Medium

scripts/auth_manager.py:219

Python shutil operations

shutil.rmtree(self.browser_state_dir)

clear_auth recursively deletes the browser-state directory, whose base path can be selected through AAS_NOTEBOOKLM_DATA_DIR. The command is intentional but lacks a containment check before destructive deletion.

Medium

scripts/config.py:32

Python shutil operations

shutil.move(str(LEGACY_DATA_DIR), str(DATA_DIR))

Sensitive legacy state is moved to DATA_DIR, which can be selected by an environment variable. An untrusted environment can redirect this migration to an unintended filesystem location.

Medium

scripts/config.py:12

Python environment access

DATA_DIR = Path(os.environ.get(

AAS_NOTEBOOKLM_DATA_DIR controls where live browser credentials are stored and which browser-state tree can later be deleted. The value is expanded without validating it against an approved application directory.

Risk Factors

📁 Filesystem access (50)

🌐 Network access (21)

🔑 Env variables (3)

README.md:258 requirements.txt:10 scripts/config.py:12

⚙️ External commands (50)

Detected Patterns

System reconnaissance

Audited by: codex

Audit version 5

Jul 9, 2026, 04:55 PM

Most static findings are documentation examples, standard Claude skill paths, or scoped local file operations. Confirmed risks include automatic setup commands, persistent Google session storage, anti-detection automation, and URL validation after navigation. No prompt-injection instructions were found.

Files scanned

4,060

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (4)

High

scripts/auth_manager.py:163-165 SKILL.md:193-198

Persistent Google Session Storage

The skill saves browser storage state to disk and documents that browser cookies and sessions are stored locally. Compromise or accidental sharing of this directory could expose NotebookLM access.

The code directly saves cookies and localStorage with context.storage_state, and the skill documentation states browser cookies and sessions are stored.

Medium

README.md:200

System reconnaissance

Uses realistic typing speeds and interaction patterns to avoid detection.

The README explicitly describes realistic interaction patterns to avoid detection. This is not system reconnaissance, but it is a real third-party automation evasion concern.

Medium

README.md:199-200 scripts/setup_environment.py:70-75

Anti-Detection Browser Automation

The skill advertises human-like interaction to avoid detection and installs Patchright Chrome for fingerprinting reliability. This raises third-party service automation and policy concerns.

README text explicitly says the automation avoids detection, and setup comments tie Chrome installation to browser fingerprinting and anti-detection behavior.

Medium

scripts/ask_question.py:74-80

Notebook URL Validated After Navigation

The question script opens the supplied notebook URL before verifying that the browser landed on notebooklm.google.com. A malicious or mistaken URL can be loaded before rejection.

The code calls page.goto(notebook_url) before the NotebookLM domain regex check, so validation happens after navigation.

Capability review items (8)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

scripts/__init__.py:53 scripts/__init__.py:65 scripts/setup_environment.py:54 scripts/setup_environment.py:75

Python subprocess.run · 4 occurrences

subprocess.run(

This is executable package initialization code, not a documentation sample. It can create a virtual environment and install dependencies, so it is real install-time command execution.

High

scripts/run.py:38

Python subprocess.run

result = subprocess.run([sys.executable, str(setup_script)])

The runner invokes setup_environment.py when the local virtual environment is missing. That setup path can install Python packages and browser components before running the requested skill script.

High

scripts/run.py:91 scripts/setup_environment.py:132

Python subprocess.run · 2 occurrences

result = subprocess.run(cmd)

The runner executes a selected local script with provided arguments. The script path is constrained to the skill scripts directory, but this remains real agent-triggered code execution.

High

scripts/setup_environment.py:62

Python subprocess.run

result = subprocess.run(

The setup script installs requirements from the marketplace package. That is real dependency installation with supply-chain exposure, even though the command is not shell-injected.

Risk Factors

📁 Filesystem access (50)

🌐 Network access (21)

🔑 Env variables (2)

README.md:258 requirements.txt:10

⚙️ External commands (78)

references/api_reference.md:160 references/api_reference.md:216 references/api_reference.md:228 references/api_reference.md:249 references/api_reference.md:271 references/troubleshooting.md:132 references/troubleshooting.md:277 references/usage_patterns.md:177 references/usage_patterns.md:210 references/usage_patterns.md:219 references/usage_patterns.md:143 scripts/__init__.py:53 scripts/__init__.py:65 scripts/run.py:38 scripts/run.py:91 scripts/setup_environment.py:54 scripts/setup_environment.py:62 scripts/setup_environment.py:75 scripts/setup_environment.py:132 SKILL.md:14 SKILL.md:24-30 SKILL.md:30-33 SKILL.md:33-34 SKILL.md:34-35 SKILL.md:35-36 SKILL.md:36-42 SKILL.md:42-44 SKILL.md:44-52 SKILL.md:52-54 SKILL.md:54-55 SKILL.md:55-63 SKILL.md:63-65 SKILL.md:65-70 SKILL.md:70-73 SKILL.md:73-83 SKILL.md:83-106 SKILL.md:106-109 SKILL.md:109-110 SKILL.md:110-114 SKILL.md:114-126 SKILL.md:126-137 SKILL.md:137-139 SKILL.md:139-145 SKILL.md:145-146 SKILL.md:146-151 SKILL.md:151-153 SKILL.md:153-154 SKILL.md:154-161 SKILL.md:161-163 SKILL.md:163-164 SKILL.md:164-166 SKILL.md:166-168 SKILL.md:168-169 SKILL.md:169-173 SKILL.md:173-178 SKILL.md:178-184 SKILL.md:184-189 SKILL.md:189-193 SKILL.md:193-194 SKILL.md:194-195 SKILL.md:195-196 SKILL.md:196-198 SKILL.md:198-202 SKILL.md:202-203 SKILL.md:203-210 SKILL.md:210-214 SKILL.md:214-230 SKILL.md:230-236 SKILL.md:236-239 SKILL.md:239-240 SKILL.md:240-262 SKILL.md:262-263 SKILL.md:263-264 SKILL.md:264-265 SKILL.md:265-266 SKILL.md:266-267 SKILL.md:267-268 SKILL.md:268-269

Detected Patterns

System reconnaissance

Audited by: codex

Audit version 4

Jul 9, 2026, 04:55 PM

Files scanned

4,060

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (4)

High

scripts/auth_manager.py:163-165 SKILL.md:193-198

Persistent Google Session Storage

The skill saves browser storage state to disk and documents that browser cookies and sessions are stored locally. Compromise or accidental sharing of this directory could expose NotebookLM access.

The code directly saves cookies and localStorage with context.storage_state, and the skill documentation states browser cookies and sessions are stored.

Medium

README.md:200

System reconnaissance

Uses realistic typing speeds and interaction patterns to avoid detection.

The README explicitly describes realistic interaction patterns to avoid detection. This is not system reconnaissance, but it is a real third-party automation evasion concern.

Medium

README.md:199-200 scripts/setup_environment.py:70-75

Anti-Detection Browser Automation

The skill advertises human-like interaction to avoid detection and installs Patchright Chrome for fingerprinting reliability. This raises third-party service automation and policy concerns.

README text explicitly says the automation avoids detection, and setup comments tie Chrome installation to browser fingerprinting and anti-detection behavior.

Medium

scripts/ask_question.py:74-80

Notebook URL Validated After Navigation

The question script opens the supplied notebook URL before verifying that the browser landed on notebooklm.google.com. A malicious or mistaken URL can be loaded before rejection.

The code calls page.goto(notebook_url) before the NotebookLM domain regex check, so validation happens after navigation.

Capability review items (8)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

scripts/__init__.py:53 scripts/__init__.py:65 scripts/setup_environment.py:54 scripts/setup_environment.py:75

Python subprocess.run · 4 occurrences

subprocess.run(

This is executable package initialization code, not a documentation sample. It can create a virtual environment and install dependencies, so it is real install-time command execution.

High

scripts/run.py:38

Python subprocess.run

result = subprocess.run([sys.executable, str(setup_script)])

The runner invokes setup_environment.py when the local virtual environment is missing. That setup path can install Python packages and browser components before running the requested skill script.

High

scripts/run.py:91 scripts/setup_environment.py:132

Python subprocess.run · 2 occurrences

result = subprocess.run(cmd)

The runner executes a selected local script with provided arguments. The script path is constrained to the skill scripts directory, but this remains real agent-triggered code execution.

High

scripts/setup_environment.py:62

Python subprocess.run

result = subprocess.run(

The setup script installs requirements from the marketplace package. That is real dependency installation with supply-chain exposure, even though the command is not shell-injected.

Risk Factors

📁 Filesystem access (50)

🌐 Network access (21)

🔑 Env variables (2)

README.md:258 requirements.txt:10

⚙️ External commands (78)

Detected Patterns

System reconnaissance

Audited by: codex

Audit version 3

Jul 7, 2026, 01:31 AM

Most static hits in Markdown examples and installation paths are false positives, but the live scripts do execute subprocesses, install dependencies and Chrome, contact NotebookLM, and persist Google browser state. I found no evidence of credential exfiltration to an unknown endpoint, but unencrypted session-cookie storage, anti-detection browser automation, and agent-control text in tool output create high-risk marketplace concerns. Manual review and consent gating are required before publication.

Files scanned

4,060

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (4)

High

README.md:200

System reconnaissance

Uses realistic typing speeds and interaction patterns to avoid detection.

The line explicitly says the skill uses realistic interaction patterns to avoid detection. Although the static label is imprecise, this is real automation-evasion intent.

High

scripts/auth_manager.py:160-165 AUTHENTICATION.md:100-108 README.md:272-275

Persistent Google Browser Session Storage

The skill intentionally saves Google NotebookLM browser state, including cookies and local storage, to disk for reuse. This creates high impact if the local skill directory is exposed or copied.

The code directly saves browser storage state, and the documentation says state.json contains cookies and localStorage. This confirms sensitive session handling without evidence of external exfiltration.

High

README.md:199-200 scripts/setup_environment.py:70-76 AUTHENTICATION.md:87-95

Anti-Detection Browser Automation

The skill documents human-like interaction, browser fingerprint consistency, and Patchright anti-detection setup for automating Google NotebookLM. This creates account, compliance, and marketplace abuse risk.

Multiple files describe anti-detection or fingerprint-consistency behavior connected to a real external Google service. The behavior is intentional, not an incidental library detail.

High

scripts/ask_question.py:29-37 SKILL.md:128-141

Prompt Injection Attempt Detected

The skill appends directive text to NotebookLM answers and instructs the agent to stop, analyze, and run follow-up queries before responding. This blends tool output with agent-control instructions.

The directive is explicit and is appended to returned answer text, which can influence the agent after external content is retrieved. It does not bypass security controls directly, so confidence is high but not maximal.

Capability review items (24)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

AUTHENTICATION.md:101 README.md:266

Hidden file in home directory · 2 occurrences

~/.claude/skills/notebooklm/data/

This path is the documented storage location for NotebookLM library data, auth metadata, and browser state. Storing Google session cookies and notebook links under a hidden skill directory is a real local secrecy risk.

High

references/api_reference.md:185

Hidden file in home directory

Location: `~/.claude/skills/notebooklm/data/`

High

scripts/__init__.py:53 scripts/__init__.py:65 scripts/setup_environment.py:54 scripts/setup_environment.py:75

Python subprocess.run · 4 occurrences

subprocess.run(

The package initializer can run pip and browser installation subprocesses during environment setup. This is intentional, but import-time installer execution is a real supply-chain and local execution risk.

High

scripts/run.py:38

Python subprocess.run

result = subprocess.run([sys.executable, str(setup_script)])

The runner delegates setup and script execution to subprocess calls. The script path is local, but this is real command execution used by the skill.

High

scripts/run.py:91 scripts/setup_environment.py:132

Python subprocess.run · 2 occurrences

result = subprocess.run(cmd)

The runner delegates setup and script execution to subprocess calls. The script path is local, but this is real command execution used by the skill.

High

scripts/setup_environment.py:62

Python subprocess.run

result = subprocess.run(

The setup script runs pip, Patchright browser installation, or a selected local script through subprocess. Arguments are list-based, but it still executes external installers and local code on the user machine.

High

SKILL.md:193

Hidden file in home directory

All data stored in `~/.claude/skills/notebooklm/data/`:

Medium

AUTHENTICATION.md:101 README.md:266

Hidden file access · 2 occurrences

~/.claude/skills/notebooklm/data/

Medium

references/api_reference.md:185

Hidden file access

Location: `~/.claude/skills/notebooklm/data/`

Medium

scripts/auth_manager.py:177

Python file write/append

with open(self.auth_info_file, 'w') as f:

The code writes authentication metadata in the skill data directory. The write is scoped, but it is part of a flow that persists Google browser session state locally.

Medium

scripts/auth_manager.py:204

Python shutil operations

shutil.rmtree(self.browser_state_dir)

The code removes the stored browser state directory when clearing authentication. The path is scoped, but the operation is destructive to local session data and must remain user-directed.

Medium

scripts/notebook_manager.py:58

Python file write/append

with open(self.library_file, 'w') as f:

The code writes saved notebook URLs and metadata to a local library file. The path is scoped, but private notebook links and descriptions can be sensitive.

Medium

SKILL.md:193

Hidden file access

All data stored in `~/.claude/skills/notebooklm/data/`:

Low

scripts/ask_question.py:80

Hardcoded URL

page.wait_for_url(re.compile(r"^https://notebooklm\.google\.com/"), timeout=10000)

The live code connects browser automation to notebooklm.google.com for authentication or notebook queries. This is expected functionality, but it sends user questions and account session traffic to an external Google service.

Low

scripts/auth_manager.py:114

Hardcoded URL

page.goto("https://notebooklm.google.com", wait_until="domcontentloaded")

Low

scripts/auth_manager.py:129

Hardcoded URL

page.wait_for_url(re.compile(r"^https://notebooklm\.google\.com/"), timeout=timeout_ms)

Low

scripts/auth_manager.py:260

Hardcoded URL

page.goto("https://notebooklm.google.com", wait_until="domcontentloaded", timeout=30000)

Low

scripts/setup_environment.py:72

Hardcoded URL

# See: https://github.com/Kaliiiiiiiiii-Vinyzu/patchright-python#anti-detection

The URL appears in a comment, but it documents Patchright anti-detection setup tied to browser installation. It is kept as supporting evidence for automation-evasion behavior.

Risk Factors

📁 Filesystem access (50)

🌐 Network access (21)

🔑 Env variables (2)

README.md:258 requirements.txt:10

⚙️ External commands (78)

Detected Patterns

System reconnaissance

Audited by: codex

Audit version 2

Jun 30, 2026, 04:56 PM

Static analysis correctly identified a high-risk combination of scripts, network access, filesystem writes, browser session storage, and external commands. I found no evidence of prompt injection or third-party credential exfiltration, but the skill intentionally stores Google cookies and automates NotebookLM with anti-detection browser tooling, so it should not be published without human policy review.

Files scanned

4,060

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (3)

High

scripts/auth_manager.py:160-164 AUTHENTICATION.md:100-107 AUTHENTICATION.md:113-119

Persistent Google Browser Session Storage

The skill intentionally saves Google NotebookLM browser state, including cookies and local storage, to disk for reuse. This is core functionality but creates high impact if the local skill directory is exposed or mishandled.

The code directly calls storage_state to save cookies and documentation explicitly describes state.json as cookies plus localStorage. This confirms a real sensitive-data handling risk, even without evidence of exfiltration.

High

scripts/setup_environment.py:70-76 AUTHENTICATION.md:54-58 scripts/ask_question.py:6-9

Anti-Detection Browser Automation Against Google Service

The skill uses Patchright and browser fingerprint consistency to automate NotebookLM. This may violate service expectations and increases account, compliance, and abuse risk for marketplace users.

Multiple files describe browser fingerprint consistency, Patchright setup, and manual cookie injection. The behavior is intentional and connected to a real external Google service.

Medium

scripts/run.py:26-39 scripts/run.py:83-91 scripts/setup_environment.py:49-76

Automatic Subprocess Execution and Dependency Installation

The runner creates a virtual environment, installs dependencies, installs a browser, and executes selected local Python scripts. Arguments are list-based and paths are constrained, but the behavior still executes code and network installation steps on the user machine.

The subprocess calls are explicit and perform installation and execution. The implementation avoids shell=True and uses local paths, so this is elevated operational risk rather than confirmed command injection.

Capability review items (2)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

scripts/cleanup_manager.py:139-176 scripts/cleanup_manager.py:270-285

Local Data Deletion Utility

The cleanup manager can delete browser state, sessions, library data, authentication metadata, and other files under the skill data directory. The design includes preview and confirmation, reducing likelihood of accidental deletion.

The file deletion logic is present and uses shutil.rmtree and unlink. It appears scoped and user-confirmed, so it is a legitimate utility with moderate filesystem risk.

Low

requirements.txt:9-10 SKILL.md:200-209 references/api_reference.md:197-208

Optional Environment Configuration Dependency

The package includes python-dotenv and documents optional .env settings. I did not find evidence of secret exfiltration, but environment file support can expose local configuration if expanded later.

The dependency and documentation are real, but reviewed code did not show broad environment secret collection. This is a low-confidence future misuse concern.

Static false positives ignored (2)

These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.

Low

SKILL.md:23-30 SKILL.md:40-52 README.md:40-42

Markdown Command Examples Misclassified as Ruby Backticks

Many static external-command findings are Markdown code fences and inline shell examples in documentation, not Ruby execution inside application code. They are still operational instructions, but not hidden runtime behavior.

The cited lines are Markdown examples and instructions, not executable Ruby source. Static pattern matching likely interpreted backticks and fenced commands as code execution.

Low

README.md:38 SKILL.md:93-96 references/usage_patterns.md:31-33

Weak Crypto and C2 Keyword Matches Are False Positives

Several blocker findings appear to match benign text such as NotebookLM, Gemini model descriptions, or example topic names. I did not find evidence that the skill implements cryptography or command-and-control behavior.

The cited contexts are product descriptions and user examples. No cryptographic implementation or C2-style endpoint was found in the reviewed files.

Risk Factors

⚡ Contains scripts (3)

scripts/run.py:1-5 scripts/ask_question.py:1-9 scripts/auth_manager.py:1-10

🌐 Network access (3)

scripts/auth_manager.py:112-129 scripts/ask_question.py:74-80 scripts/setup_environment.py:70-76

📁 Filesystem access (3)

scripts/auth_manager.py:160-178 scripts/notebook_manager.py:50-59 scripts/cleanup_manager.py:139-176

🔑 Env variables (3)

requirements.txt:9-10 SKILL.md:200-209 references/api_reference.md:197-208

⚙️ External commands (3)

scripts/run.py:26-39 scripts/run.py:83-91 scripts/setup_environment.py:49-76

Detected Patterns

Persistent Google Browser Session StorageAnti-Detection Browser Automation Against Google ServiceAutomatic Subprocess Execution and Dependency Installation

Audited by: codex

Audit version 1

Feb 24, 2026, 04:47 PM

Static scanner detected 558 pattern matches across 20 files, but evaluation confirms most are false positives in documentation. Real risks: browser automation saves Google auth cookies locally, network access to notebooklm.google.com, and subprocess execution for internal scripts. All patterns are expected for legitimate NotebookLM integration. Markdown files triggered external_commands detections from code examples. Recommend warnings about authentication requirements and network dependency.

Files scanned

4,136

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (1)

Low

scripts/auth_manager.py:45-46

Hidden Directory File Access

Skill reads/writes to ~/.claude/skills/notebooklm/data/ for local storage. This is the skill's designated data directory, not unauthorized access.

Directory creation in skill's own data path - expected behavior, not suspicious hidden file access

Capability review items (4)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

scripts/auth_manager.py:163-165

Browser Credential Storage

Skill saves Google authentication cookies to local storage at ~/.claude/skills/notebooklm/data/. This is necessary for browser automation but creates a local credential store.

Clear evidence of context.storage_state() saving cookies to disk - standard browser automation pattern but requires user awareness

Medium

scripts/ask_question.py:80 scripts/auth_manager.py:114

External Network Dependency

Skill requires network access to notebooklm.google.com for all operations. Cannot function offline or if Google blocks automated access.

Direct page.goto() calls to notebooklm.google.com - core functionality depends on external service availability

Low

scripts/run.py:38 scripts/run.py:91

Subprocess Execution for Script Runner

run.py uses subprocess.run to execute Python scripts within the virtual environment. All commands are hardcoded with no user input injection.

subprocess.run with hardcoded script paths - legitimate internal process execution, not user-controlled

Low

requirements.txt:10

Environment Variable Access

Uses python-dotenv for optional .env configuration. Standard pattern for local configuration management.

python-dotenv is standard configuration library - low risk when not combined with exfiltration vectors

Risk Factors

⚙️ External commands (4)

scripts/run.py:38 scripts/run.py:91 scripts/setup_environment.py:54 scripts/setup_environment.py:62

🌐 Network access (3)

scripts/ask_question.py:80 scripts/auth_manager.py:114 scripts/auth_manager.py:260

📁 Filesystem access (3)

scripts/auth_manager.py:163-165 scripts/auth_manager.py:203-206 scripts/notebook_manager.py:58

🔑 Env variables (1)

requirements.txt:10

Audited by: claude

← Back to Skill