📦
Audit History
notebooklm - 5 audits
Version comparison
Capability and finding changes across audited versions, newest first.
| Version | Date | Result | Review items | Change vs previous |
|---|---|---|---|---|
| v5 Latest | Jul 8, 2026, 01:32 PM | 4 confirmed | 16 | No capability change |
| v4 | Jul 8, 2026, 01:32 PM | 4 confirmed | 16 | Contains scripts |
| v3 | Jul 1, 2026, 02:49 AM | 1 confirmed | 5 | No capability change |
| v2 | Jul 1, 2026, 02:49 AM | 1 confirmed | 5 | Contains scripts |
| v1 | Feb 24, 2026, 09:25 AM | No confirmed findings | 5 | Baseline |
Audit version 5 Latest
Jul 8, 2026, 01:32 PM
Executable scripts use subprocess to set up an environment, install dependencies, install browser binaries, and run local scripts. Many Markdown detections are false positives, but the real code still stores session state and automates Google NotebookLM. Before publication, add explicit consent, URL validation, credential storage protections, and command allowlisting.
15
Files scanned
3,425
Lines analyzed
24
Review items
0
False positives ignored
Confirmed security concerns (4)
High
Persistent Google Session Storage
The skill saves browser storage state for NotebookLM authentication and documents browser cookies and session data in local skill storage. This keeps Google session material on disk and increases exposure if local files are read.
auth_manager.py directly saves browser storage state to disk, and SKILL.md identifies browser cookies and session storage. This is clear persistent credential-adjacent material.
High
Unvalidated Notebook URL Opened With Authenticated Browser
The question interface accepts a notebook URL and opens it in the browser before the NotebookLM domain wait succeeds. A malicious or mistaken URL can load in an authenticated browser profile before validation fails.
The URL is supplied by arguments or library metadata and page.goto runs before domain enforcement. The risk is bounded by browser origin controls but still exposes the authenticated browser session to arbitrary navigation.
High
Stealth Browser Automation Against Google NotebookLM
The skill installs a browser for Patchright anti-detection use, configures stealth-related settings, and simulates human typing. This increases abuse and account-policy risk for an external Google service.
The comments and configuration explicitly reference anti-detection and stealth behavior, and ask_question.py uses human-like typing and delay logic. The intent is clear even though it supports the stated feature.
Medium
Tool Output Can Steer Agent Follow-Up Behavior
The skill appends a strong follow-up instruction to NotebookLM answers and tells the agent to stop, analyze, and ask more questions before responding. NotebookLM answers originate from uploaded documents, so source content can influence agent control flow unless treated as untrusted.
The follow-up instruction is explicit in both code and skill instructions. I did not find a malicious prompt injection string, but the design creates a reliable path for untrusted source text to affect agent behavior.
Capability review items (16)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
scripts/__init__.py:53scripts/__init__.py:65scripts/setup_environment.py:54scripts/setup_environment.py:75
Python subprocess.run · 4 occurrences
subprocess.run(
On import, the package runs pip install against requirements.txt in the skill venv. Automatic dependency installation executes external package code and is a real supply-chain risk.
High
Python subprocess.run
result = subprocess.run([sys.executable, str(setup_script)])
run.py automatically invokes setup_environment.py when the venv is missing. That bootstrap path can install dependencies and browser binaries before the requested task runs.
High
Python subprocess.run · 2 occurrences
result = subprocess.run(cmd)
run.py executes a command built from the requested script name and arguments. It is scoped to the scripts directory, but there is no explicit allowlist before subprocess execution.
High
Python subprocess.run
result = subprocess.run(
The setup code installs requirements.txt through pip. Installing dependencies at runtime is a real external code execution and supply-chain risk.
Medium
Python file write/append
with open(self.auth_info_file, 'w') as f:
The skill writes authentication metadata to a local auth_info file. The path is scoped, but it persists account-related state on disk.
Medium
Python shutil operations
shutil.rmtree(self.browser_state_dir)
clear_auth removes the browser state directory with shutil.rmtree. The path is scoped to skill data, but it is a destructive operation over stored session material.
Medium
Python shutil operations
shutil.rmtree(path)
The cleanup command deletes discovered data paths with shutil.rmtree. It is scoped and usually confirmed, but it can remove browser state, sessions, and library data.
Medium
Python file write/append
with open(self.library_file, 'w') as f:
The library manager writes notebook URLs and metadata to disk. The file is scoped, but it persists user research context and access URLs locally.
Low
Hardcoded URL
page.wait_for_url(re.compile(r"^https://notebooklm\.google\.com/"), timeout=10000)
The code validates that navigation reaches notebooklm.google.com during a query. This is intended, but it confirms external Google network access for user questions and notebooks.
Low
Hardcoded URL
page.goto("https://notebooklm.google.com", wait_until="domcontentloaded")
The authentication flow opens notebooklm.google.com in a persistent browser context. This is intended, but it sends browser traffic to an external Google service.
Low
Hardcoded URL
page.wait_for_url(re.compile(r"^https://notebooklm\.google\.com/"), timeout=timeout_ms)
The login flow waits for a NotebookLM URL after Google authentication. This confirms external network use tied to a user account.
Low
Hardcoded URL
page.goto("https://notebooklm.google.com", wait_until="domcontentloaded", timeout=30000)
The validation flow opens notebooklm.google.com to check stored authentication. This is intended, but it uses external network access with saved browser state.
Risk Factors
⚙️ External commands (78)
references/api_reference.md:160 references/api_reference.md:216 references/api_reference.md:228 references/api_reference.md:249 references/api_reference.md:271 references/troubleshooting.md:132 references/troubleshooting.md:277 references/usage_patterns.md:177 references/usage_patterns.md:210 references/usage_patterns.md:219 references/usage_patterns.md:143 scripts/__init__.py:53 scripts/__init__.py:65 scripts/run.py:38 scripts/run.py:91 scripts/setup_environment.py:54 scripts/setup_environment.py:62 scripts/setup_environment.py:75 scripts/setup_environment.py:132 SKILL.md:14 SKILL.md:24-30 SKILL.md:30-33 SKILL.md:33-34 SKILL.md:34-35 SKILL.md:35-36 SKILL.md:36-42 SKILL.md:42-44 SKILL.md:44-52 SKILL.md:52-54 SKILL.md:54-55 SKILL.md:55-63 SKILL.md:63-65 SKILL.md:65-70 SKILL.md:70-73 SKILL.md:73-83 SKILL.md:83-106 SKILL.md:106-109 SKILL.md:109-110 SKILL.md:110-114 SKILL.md:114-126 SKILL.md:126-137 SKILL.md:137-139 SKILL.md:139-145 SKILL.md:145-146 SKILL.md:146-151 SKILL.md:151-153 SKILL.md:153-154 SKILL.md:154-161 SKILL.md:161-163 SKILL.md:163-164 SKILL.md:164-166 SKILL.md:166-168 SKILL.md:168-169 SKILL.md:169-173 SKILL.md:173-178 SKILL.md:178-184 SKILL.md:184-189 SKILL.md:189-193 SKILL.md:193-194 SKILL.md:194-195 SKILL.md:195-196 SKILL.md:196-198 SKILL.md:198-202 SKILL.md:202-203 SKILL.md:203-210 SKILL.md:210-214 SKILL.md:214-230 SKILL.md:230-236 SKILL.md:236-239 SKILL.md:239-240 SKILL.md:240-262 SKILL.md:262-263 SKILL.md:263-264 SKILL.md:264-265 SKILL.md:265-266 SKILL.md:266-267 SKILL.md:267-268 SKILL.md:268-269
🌐 Network access (19)
references/api_reference.md:30 references/api_reference.md:52 references/api_reference.md:59 references/troubleshooting.md:148 references/troubleshooting.md:209 references/troubleshooting.md:210 references/troubleshooting.md:209 references/troubleshooting.md:210 references/usage_patterns.md:31 scripts/ask_question.py:9 scripts/ask_question.py:80 scripts/auth_manager.py:10 scripts/auth_manager.py:114 scripts/auth_manager.py:129 scripts/auth_manager.py:260 scripts/setup_environment.py:72 SKILL.md:14 SKILL.md:93 SKILL.md:122
📁 Filesystem access (32)
references/api_reference.md:185 references/api_reference.md:185 references/troubleshooting.md:101 references/troubleshooting.md:223 references/troubleshooting.md:226 references/troubleshooting.md:236 references/troubleshooting.md:282 references/troubleshooting.md:283 references/troubleshooting.md:287 references/troubleshooting.md:298 references/troubleshooting.md:299 references/troubleshooting.md:306 references/troubleshooting.md:353 references/troubleshooting.md:361 references/troubleshooting.md:101 references/troubleshooting.md:223 references/troubleshooting.md:226 references/troubleshooting.md:236 references/troubleshooting.md:282 references/troubleshooting.md:283 references/troubleshooting.md:287 references/troubleshooting.md:298 references/troubleshooting.md:299 references/troubleshooting.md:306 references/troubleshooting.md:353 references/troubleshooting.md:361 scripts/auth_manager.py:177 scripts/auth_manager.py:204 scripts/cleanup_manager.py:173 scripts/notebook_manager.py:58 SKILL.md:193 SKILL.md:193
🔑 Env variables (1)
Audited by: codex
Jul 8, 2026, 01:32 PM
Executable scripts use subprocess to set up an environment, install dependencies, install browser binaries, and run local scripts. Many Markdown detections are false positives, but the real code still stores session state and automates Google NotebookLM. Before publication, add explicit consent, URL validation, credential storage protections, and command allowlisting.
15
Files scanned
3,425
Lines analyzed
24
Review items
0
False positives ignored
Confirmed security concerns (4)
High
Persistent Google Session Storage
The skill saves browser storage state for NotebookLM authentication and documents browser cookies and session data in local skill storage. This keeps Google session material on disk and increases exposure if local files are read.
auth_manager.py directly saves browser storage state to disk, and SKILL.md identifies browser cookies and session storage. This is clear persistent credential-adjacent material.
High
Unvalidated Notebook URL Opened With Authenticated Browser
The question interface accepts a notebook URL and opens it in the browser before the NotebookLM domain wait succeeds. A malicious or mistaken URL can load in an authenticated browser profile before validation fails.
The URL is supplied by arguments or library metadata and page.goto runs before domain enforcement. The risk is bounded by browser origin controls but still exposes the authenticated browser session to arbitrary navigation.
High
Stealth Browser Automation Against Google NotebookLM
The skill installs a browser for Patchright anti-detection use, configures stealth-related settings, and simulates human typing. This increases abuse and account-policy risk for an external Google service.
The comments and configuration explicitly reference anti-detection and stealth behavior, and ask_question.py uses human-like typing and delay logic. The intent is clear even though it supports the stated feature.
Medium
Tool Output Can Steer Agent Follow-Up Behavior
The skill appends a strong follow-up instruction to NotebookLM answers and tells the agent to stop, analyze, and ask more questions before responding. NotebookLM answers originate from uploaded documents, so source content can influence agent control flow unless treated as untrusted.
The follow-up instruction is explicit in both code and skill instructions. I did not find a malicious prompt injection string, but the design creates a reliable path for untrusted source text to affect agent behavior.
Capability review items (16)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
scripts/__init__.py:53scripts/__init__.py:65scripts/setup_environment.py:54scripts/setup_environment.py:75
Python subprocess.run · 4 occurrences
subprocess.run(
On import, the package runs pip install against requirements.txt in the skill venv. Automatic dependency installation executes external package code and is a real supply-chain risk.
High
Python subprocess.run
result = subprocess.run([sys.executable, str(setup_script)])
run.py automatically invokes setup_environment.py when the venv is missing. That bootstrap path can install dependencies and browser binaries before the requested task runs.
High
Python subprocess.run · 2 occurrences
result = subprocess.run(cmd)
run.py executes a command built from the requested script name and arguments. It is scoped to the scripts directory, but there is no explicit allowlist before subprocess execution.
High
Python subprocess.run
result = subprocess.run(
The setup code installs requirements.txt through pip. Installing dependencies at runtime is a real external code execution and supply-chain risk.
Medium
Python file write/append
with open(self.auth_info_file, 'w') as f:
The skill writes authentication metadata to a local auth_info file. The path is scoped, but it persists account-related state on disk.
Medium
Python shutil operations
shutil.rmtree(self.browser_state_dir)
clear_auth removes the browser state directory with shutil.rmtree. The path is scoped to skill data, but it is a destructive operation over stored session material.
Medium
Python shutil operations
shutil.rmtree(path)
The cleanup command deletes discovered data paths with shutil.rmtree. It is scoped and usually confirmed, but it can remove browser state, sessions, and library data.
Medium
Python file write/append
with open(self.library_file, 'w') as f:
The library manager writes notebook URLs and metadata to disk. The file is scoped, but it persists user research context and access URLs locally.
Low
Hardcoded URL
page.wait_for_url(re.compile(r"^https://notebooklm\.google\.com/"), timeout=10000)
The code validates that navigation reaches notebooklm.google.com during a query. This is intended, but it confirms external Google network access for user questions and notebooks.
Low
Hardcoded URL
page.goto("https://notebooklm.google.com", wait_until="domcontentloaded")
The authentication flow opens notebooklm.google.com in a persistent browser context. This is intended, but it sends browser traffic to an external Google service.
Low
Hardcoded URL
page.wait_for_url(re.compile(r"^https://notebooklm\.google\.com/"), timeout=timeout_ms)
The login flow waits for a NotebookLM URL after Google authentication. This confirms external network use tied to a user account.
Low
Hardcoded URL
page.goto("https://notebooklm.google.com", wait_until="domcontentloaded", timeout=30000)
The validation flow opens notebooklm.google.com to check stored authentication. This is intended, but it uses external network access with saved browser state.
Risk Factors
⚙️ External commands (78)
references/api_reference.md:160 references/api_reference.md:216 references/api_reference.md:228 references/api_reference.md:249 references/api_reference.md:271 references/troubleshooting.md:132 references/troubleshooting.md:277 references/usage_patterns.md:177 references/usage_patterns.md:210 references/usage_patterns.md:219 references/usage_patterns.md:143 scripts/__init__.py:53 scripts/__init__.py:65 scripts/run.py:38 scripts/run.py:91 scripts/setup_environment.py:54 scripts/setup_environment.py:62 scripts/setup_environment.py:75 scripts/setup_environment.py:132 SKILL.md:14 SKILL.md:24-30 SKILL.md:30-33 SKILL.md:33-34 SKILL.md:34-35 SKILL.md:35-36 SKILL.md:36-42 SKILL.md:42-44 SKILL.md:44-52 SKILL.md:52-54 SKILL.md:54-55 SKILL.md:55-63 SKILL.md:63-65 SKILL.md:65-70 SKILL.md:70-73 SKILL.md:73-83 SKILL.md:83-106 SKILL.md:106-109 SKILL.md:109-110 SKILL.md:110-114 SKILL.md:114-126 SKILL.md:126-137 SKILL.md:137-139 SKILL.md:139-145 SKILL.md:145-146 SKILL.md:146-151 SKILL.md:151-153 SKILL.md:153-154 SKILL.md:154-161 SKILL.md:161-163 SKILL.md:163-164 SKILL.md:164-166 SKILL.md:166-168 SKILL.md:168-169 SKILL.md:169-173 SKILL.md:173-178 SKILL.md:178-184 SKILL.md:184-189 SKILL.md:189-193 SKILL.md:193-194 SKILL.md:194-195 SKILL.md:195-196 SKILL.md:196-198 SKILL.md:198-202 SKILL.md:202-203 SKILL.md:203-210 SKILL.md:210-214 SKILL.md:214-230 SKILL.md:230-236 SKILL.md:236-239 SKILL.md:239-240 SKILL.md:240-262 SKILL.md:262-263 SKILL.md:263-264 SKILL.md:264-265 SKILL.md:265-266 SKILL.md:266-267 SKILL.md:267-268 SKILL.md:268-269
🌐 Network access (19)
references/api_reference.md:30 references/api_reference.md:52 references/api_reference.md:59 references/troubleshooting.md:148 references/troubleshooting.md:209 references/troubleshooting.md:210 references/troubleshooting.md:209 references/troubleshooting.md:210 references/usage_patterns.md:31 scripts/ask_question.py:9 scripts/ask_question.py:80 scripts/auth_manager.py:10 scripts/auth_manager.py:114 scripts/auth_manager.py:129 scripts/auth_manager.py:260 scripts/setup_environment.py:72 SKILL.md:14 SKILL.md:93 SKILL.md:122
📁 Filesystem access (32)
references/api_reference.md:185 references/api_reference.md:185 references/troubleshooting.md:101 references/troubleshooting.md:223 references/troubleshooting.md:226 references/troubleshooting.md:236 references/troubleshooting.md:282 references/troubleshooting.md:283 references/troubleshooting.md:287 references/troubleshooting.md:298 references/troubleshooting.md:299 references/troubleshooting.md:306 references/troubleshooting.md:353 references/troubleshooting.md:361 references/troubleshooting.md:101 references/troubleshooting.md:223 references/troubleshooting.md:226 references/troubleshooting.md:236 references/troubleshooting.md:282 references/troubleshooting.md:283 references/troubleshooting.md:287 references/troubleshooting.md:298 references/troubleshooting.md:299 references/troubleshooting.md:306 references/troubleshooting.md:353 references/troubleshooting.md:361 scripts/auth_manager.py:177 scripts/auth_manager.py:204 scripts/cleanup_manager.py:173 scripts/notebook_manager.py:58 SKILL.md:193 SKILL.md:193
🔑 Env variables (1)
Audited by: codex
Jul 1, 2026, 02:49 AM
Static analysis flagged many shell-command patterns; most markdown hits are command examples or API documentation, not executable backticks. The executable scripts still confirm high-risk behavior because the skill installs dependencies and a browser, automates Google NotebookLM in an authenticated Chrome profile, and stores reusable browser state containing cookies or local storage.
15
Files scanned
3,425
Lines analyzed
11
Review items
1
False positives ignored
Confirmed security concerns (1)
Low
Markdown Command Examples Triggered Shell Pattern Alerts
Many static findings in SKILL.md and references files are bash or Python snippets showing how to call the provided scripts. These examples are not executed by the files themselves, but they document commands that users may run manually.
The cited locations are fenced markdown examples or troubleshooting snippets, not runtime code. They remain relevant because the commands point to executable scripts with confirmed side effects.
Capability review items (5)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Persistent Google Browser State Stored Locally
The skill saves authenticated browser storage to disk and documents that browser cookies and session data are retained. This is necessary for the workflow, but it creates account takeover risk if the skill directory or generated data is exposed.
The code directly calls storage_state with a path, and the skill documentation states that browser cookies and session data are stored. The risk is confirmed, although it appears tied to legitimate NotebookLM authentication rather than confirmed exfiltration.
High
Automated Dependency and Browser Installation
The runner creates a virtual environment, installs Python dependencies, upgrades pip, and installs a Patchright Chrome browser automatically. This increases supply-chain and execution risk for a marketplace skill because first use can fetch and execute third-party packages.
The subprocess calls are explicit and install requirements plus a browser runtime. The behavior is documented and purposeful, but it is high impact because package installation happens from skill execution flow.
High
Stealth Browser Automation Against Google Services
The skill depends on Patchright and configures real Chrome automation for NotebookLM login and queries. This may violate service expectations, can trigger account controls, and requires handling authenticated browser data with care.
The dependency and setup comments explicitly identify Patchright and Chrome automation, while auth_manager drives an authenticated browser session. I did not find evidence of malicious network destinations, so confidence is high for risk but not for malicious intent.
Medium
Notebook URL Is Navigated Before Domain Validation Completes
The question script accepts a notebook URL from command-line arguments or saved library data and navigates to it before checking that the final URL is a NotebookLM domain. A malicious or mistaken URL could load unexpected content in the skill-controlled browser context.
The URL parameter is accepted and passed to page.goto before the NotebookLM regex wait. Browser cookie scoping limits direct cookie leakage, but the ordering still creates avoidable navigation risk.
Medium
Local Cleanup Deletes Skill Data Directories
The cleanup command recursively deletes browser state and other files under the skill data directory when confirmed. The implementation scopes deletion to the skill data path and previews by default, so this is a moderate operational risk rather than malicious behavior.
The recursive deletion is explicit and confirmed by code, but it is limited to computed cleanup paths under data_dir and has a confirmation flow unless forced.
Static false positives ignored (1)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Low
Weak Cryptography Alerts Appear To Be Textual False Positives
Static weak-crypto alerts appear to match ordinary words such as description, id, or session text in documentation and script metadata. I did not find evidence of cryptographic primitives being used for protection in the reviewed files.
Searches for crypto-related APIs found no implemented weak cryptographic algorithm in the reviewed script paths. The static line hits correspond to benign text or metadata fields.
Risk Factors
⚡ Contains scripts (4)
⚙️ External commands (4)
🌐 Network access (4)
📁 Filesystem access (4)
🔑 Env variables (2)
Detected Patterns
Code Execution Plus Network Plus Credential StorageAutomatic First-Run Environment Mutation
Audited by: codex
Jul 1, 2026, 02:49 AM
Static analysis flagged many shell-command patterns; most markdown hits are command examples or API documentation, not executable backticks. The executable scripts still confirm high-risk behavior because the skill installs dependencies and a browser, automates Google NotebookLM in an authenticated Chrome profile, and stores reusable browser state containing cookies or local storage.
15
Files scanned
3,425
Lines analyzed
11
Review items
1
False positives ignored
Confirmed security concerns (1)
Low
Markdown Command Examples Triggered Shell Pattern Alerts
Many static findings in SKILL.md and references files are bash or Python snippets showing how to call the provided scripts. These examples are not executed by the files themselves, but they document commands that users may run manually.
The cited locations are fenced markdown examples or troubleshooting snippets, not runtime code. They remain relevant because the commands point to executable scripts with confirmed side effects.
Capability review items (5)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Persistent Google Browser State Stored Locally
The skill saves authenticated browser storage to disk and documents that browser cookies and session data are retained. This is necessary for the workflow, but it creates account takeover risk if the skill directory or generated data is exposed.
The code directly calls storage_state with a path, and the skill documentation states that browser cookies and session data are stored. The risk is confirmed, although it appears tied to legitimate NotebookLM authentication rather than confirmed exfiltration.
High
Automated Dependency and Browser Installation
The runner creates a virtual environment, installs Python dependencies, upgrades pip, and installs a Patchright Chrome browser automatically. This increases supply-chain and execution risk for a marketplace skill because first use can fetch and execute third-party packages.
The subprocess calls are explicit and install requirements plus a browser runtime. The behavior is documented and purposeful, but it is high impact because package installation happens from skill execution flow.
High
Stealth Browser Automation Against Google Services
The skill depends on Patchright and configures real Chrome automation for NotebookLM login and queries. This may violate service expectations, can trigger account controls, and requires handling authenticated browser data with care.
The dependency and setup comments explicitly identify Patchright and Chrome automation, while auth_manager drives an authenticated browser session. I did not find evidence of malicious network destinations, so confidence is high for risk but not for malicious intent.
Medium
Notebook URL Is Navigated Before Domain Validation Completes
The question script accepts a notebook URL from command-line arguments or saved library data and navigates to it before checking that the final URL is a NotebookLM domain. A malicious or mistaken URL could load unexpected content in the skill-controlled browser context.
The URL parameter is accepted and passed to page.goto before the NotebookLM regex wait. Browser cookie scoping limits direct cookie leakage, but the ordering still creates avoidable navigation risk.
Medium
Local Cleanup Deletes Skill Data Directories
The cleanup command recursively deletes browser state and other files under the skill data directory when confirmed. The implementation scopes deletion to the skill data path and previews by default, so this is a moderate operational risk rather than malicious behavior.
The recursive deletion is explicit and confirmed by code, but it is limited to computed cleanup paths under data_dir and has a confirmation flow unless forced.
Static false positives ignored (1)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Low
Weak Cryptography Alerts Appear To Be Textual False Positives
Static weak-crypto alerts appear to match ordinary words such as description, id, or session text in documentation and script metadata. I did not find evidence of cryptographic primitives being used for protection in the reviewed files.
Searches for crypto-related APIs found no implemented weak cryptographic algorithm in the reviewed script paths. The static line hits correspond to benign text or metadata fields.
Risk Factors
⚡ Contains scripts (4)
⚙️ External commands (4)
🌐 Network access (4)
📁 Filesystem access (4)
🔑 Env variables (2)
Detected Patterns
Code Execution Plus Network Plus Credential StorageAutomatic First-Run Environment Mutation
Audited by: codex
Feb 24, 2026, 09:25 AM
This skill is a legitimate Google NotebookLM integration using browser automation. The static findings are false positives triggered by: (1) shell command examples in documentation, (2) Playwright browser automation code for Google authentication, (3) network requests to Google's legitimate NotebookLM service. The combination of code execution + network + credentials is expected behavior for this type of integration skill.
15
Files scanned
3,425
Lines analyzed
9
Review items
0
False positives ignored
Capability review items (5)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Browser Automation with Credentials
Uses Playwright for browser automation with persistent authentication state. This is standard for skills that integrate with web services requiring login.
Legitimate browser automation for Google NotebookLM authentication. Uses Playwright with persistent context to maintain session cookies.
Medium
Shell Command Execution in Scripts
Python subprocess calls for environment setup (venv creation, pip install, patchright install). These are required for skill initialization.
Subprocess calls are used for legitimate environment setup (creating venv, installing dependencies). Arguments are hardcoded strings, no user input injection.
Medium
Network Requests to Google Services
Hardcoded URLs for Google NotebookLM API endpoints. Required for integration functionality.
Network requests go to notebooklm.google.com - Google's legitimate service. No data exfiltration to external servers.
Low
Filesystem Access for Data Storage
Accesses local filesystem to store notebook library, authentication state, and browser profile. Standard for persistent skill data.
Filesystem access is for storing skill data in ~/.claude/skills/notebooklm/data/ - standard skill storage location. No sensitive system files accessed.
Low
Environment Variable Access
Uses dotenv for optional configuration. Standard skill configuration pattern.
dotenv usage is for reading optional .env configuration file. No automatic environment variable exposure.
Risk Factors
⚙️ External commands (3)
🌐 Network access (2)
📁 Filesystem access (2)
🔑 Env variables (1)
Audited by: claude