Versioned security assessment

Report ID: SA-81E05E63

8/4/2026, 4:14:49 PM

notebooklm security assessment v6

Skill Security Certification Report

Audit History
Scanner version 3.0.0 Audit model: codex Latest published report
Skill name
notebooklm
Version
v6
Maintainer
sickn33
Source
github.com/sickn33/antigravity-awesome-skills/tree/main/skills/notebooklm
Coverage
20 Files scanned · 4,212 Lines analyzed
Policy version
skillstore-security-audit-policy-v1

Highest confirmed finding severity

High

4 confirmed security findings require attention.

Installation context

Check the current Skill page

This page summarizes report evidence only. The Skill page provides the canonical install advisory.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

The skill performs legitimate NotebookLM research automation, and most static matches are documentation or fixed commands. Confirmed risks include behavior-steering prompt injection, anti-detection automation, persistent Google session cookies, unsafe URL navigation with a disabled browser sandbox, automatic installers, and an arbitrary local Python execution path.

Report position

Latest published report

Latest refers to the report sequence, not to artifact currentness.

Audit attestation

Active attestation

A public attestation is available for this exact report.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

20 Files scanned · 4,212 Lines analyzed

13 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Commit and path bound

  2. Artifact

    Content and tree hashes bound

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 19 evidence locations

Filesystem access

May read or write local files.

Observed in 27 evidence locations

Env variables

May read values from the process environment.

Observed in 3 evidence locations

External commands

May invoke commands or programs outside the Skill.

Observed in 50 evidence locations

Capability review items (9)
High
scripts/__init__.py:53
Python subprocess.run
subprocess.run(
Importing the scripts package can invoke pip automatically to download and execute dependencies. Network package installation as an import side effect creates supply-chain and unexpected-execution risk.
High
scripts/__init__.py:65
Python subprocess.run
subprocess.run(
Importing the package can automatically run Patchright's browser installer. This downloads and executes browser setup without a separate user confirmation step.
High
scripts/setup_environment.py:54
Python subprocess.run
subprocess.run(
First-run setup automatically upgrades pip from the network. This executes newly downloaded package-management code and mutates the environment without a dedicated confirmation.
High
scripts/setup_environment.py:62
Python subprocess.run
result = subprocess.run(
First-run setup automatically installs third-party requirements from the network. Version pins reduce drift but do not remove package-index or supply-chain execution risk.
High
scripts/setup_environment.py:75
Python subprocess.run
subprocess.run(
The setup automatically invokes Patchright to download and install Chrome assets. This is a significant external side effect performed during automatic bootstrap.
High
scripts/setup_environment.py:132
Python subprocess.run
result = subprocess.run(cmd)
The --run value is joined into a script path without an allowlist or resolved-path containment check, then executed by Python. A traversal value can execute an arbitrary existing local Python file.
Medium
scripts/auth_manager.py:219
Python shutil operations
shutil.rmtree(self.browser_state_dir)
clear_auth recursively deletes the browser-state directory, whose base path can be selected through AAS_NOTEBOOKLM_DATA_DIR. The command is intentional but lacks a containment check before destructive deletion.
Medium
scripts/config.py:32
Python shutil operations
shutil.move(str(LEGACY_DATA_DIR), str(DATA_DIR))
Sensitive legacy state is moved to DATA_DIR, which can be selected by an environment variable. An untrusted environment can redirect this migration to an unintended filesystem location.
Medium
scripts/config.py:12
Python environment access
DATA_DIR = Path(os.environ.get(
AAS_NOTEBOOKLM_DATA_DIR controls where live browser credentials are stored and which browser-state tree can later be deleted. The value is expanded without validating it against an approved application directory.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (4)

RISK-001 High
README.md:200
System reconnaissance
Uses realistic typing speeds and interaction patterns to avoid detection.
The documentation explicitly says human-like interaction is used to avoid detection. This confirms deliberate evasion of Google's automation controls, not ordinary system reconnaissance.
RISK-002 High
scripts/ask_question.py:29-36SKILL.md:131-144
Prompt Injection Attempt Detected
The script appends "EXTREMELY IMPORTANT: Is that ALL you need to know?" and instructions to review the user request and ask again. This tool-output text directs the host agent's behavior and can force extra external queries before the user receives a response.
The behavior-steering text is defined in code, appended to every retrieved answer, and reinforced by explicit agent instructions in SKILL.md.
RISK-003 High
scripts/auth_manager.py:173-179scripts/browser_utils.py:46-53
Persistent Google Session Credentials
The skill saves complete browser storage state and later reinjects its cookies into a persistent Chrome context. Theft or unintended disclosure of this local state can enable Google session hijacking.
The code explicitly serializes browser cookies and local storage, applies restrictive permissions, and reloads the cookies for later authenticated sessions.
RISK-004 High
scripts/config.py:60-66scripts/ask_question.py:74-80scripts/notebook_manager.py:314-319
Unvalidated Browser Navigation Without Sandbox
A user-provided or library-stored URL is opened before its host is validated, while Chrome is launched with --no-sandbox. This permits arbitrary browser navigation and increases the impact of malicious web content.
The CLI accepts any URL, stores it without origin validation, navigates to it, and only afterward waits for the NotebookLM origin while the browser sandbox is disabled.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    High
    Tool output contains instructions that steer the host agent and trigger repeated queries.
    Remove FOLLOW_UP_REMINDER from retrieved answers. Return source content as clearly delimited untrusted data and let the host agent decide whether another query is needed.
  2. FIX-002
    High
    Chrome opens unvalidated URLs with --no-sandbox and anti-detection settings.
    Require an exact notebooklm.google.com HTTPS origin before storage or navigation, remove --no-sandbox, and remove automation-evasion flags and humanization behavior.
  3. FIX-003
    High
    The --run setup option can execute a traversed local Python path.
    Use the same script allowlist and resolved-path containment checks implemented in scripts/run.py before invoking any script.
  4. FIX-004
    High
    Google cookies and browser state persist locally and are later reinjected.
    Document account impact, use OS credential storage where possible, minimize retained state, and require explicit consent before saving or reusing authentication.
  5. FIX-005
    High
    Dependency and browser installers run automatically, including during package import.
    Remove import-time setup, require explicit installation confirmation, verify package hashes, and avoid automatically upgrading pip.
  6. FIX-006
    Medium
    An environment variable controls sensitive state and recursive deletion paths.
    Resolve and validate the data directory against an approved user-data root before migration, credential writes, or recursive deletion.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
81e05e636292629114b76cbb3922fbe57672fc02
Content hash
fe8f31e77502d277e54f04a070202047652de0bf23fd55aa245a9a0a3e0ac199
Tree hash
509b5350c54f3b5e44dcfe4f97be5e118e2db38df0dc48f3434fce09c2f067aa
Skill path
skills/sickn33/notebooklm
Audit payload hash
67291a65b3d1dbdc7ba1c5a647303c6e

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report Signed attestation CITATION.cff SARIF 2.1.0 Signed installation manifest Source

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: active