Trust Assessment
notebooklm received a trust score of 86/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 1 finding: 0 critical, 1 high, 0 medium, and 0 low severity. Key findings include Unrestricted external command execution via `spawnSync`.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Unrestricted external command execution via `spawnSync` The `scripts/notebooklm.mjs` script directly executes the `notebooklm` command using `node:child_process.spawnSync`, passing all user-provided arguments (`process.argv.slice(2)`) without any validation or sanitization. This allows an attacker to invoke any `notebooklm` command with arbitrary arguments. Depending on the capabilities of the `notebooklm` CLI, this could lead to:
1. **Command Injection:** If `notebooklm` has features to execute arbitrary scripts or commands (e.g., `notebooklm exec <script>`), an attacker could achieve arbitrary code execution.
2. **Data Exfiltration:** If `notebooklm` can read local files and output their content or transmit them (e.g., `notebooklm export --file /etc/passwd`), sensitive data could be exfiltrated.
3. **Excessive Permissions:** The skill effectively grants the LLM full control over the `notebooklm` CLI, bypassing any intended restrictions. Implement a strict whitelist of allowed `notebooklm` commands and arguments. All user-provided arguments must be validated and sanitized against this whitelist before being passed to `spawnSync`. Consider using a more restricted execution environment (e.g., containerization) for the `notebooklm` process to limit its potential impact. | LLM | scripts/notebooklm.mjs:15 |
Scan History
Embed Code
[](https://skillshield.io/report/b5b2119238755f64)
Powered by SkillShield