Is lhquangit/notebooklm-cli-cookies safe?
Use with caution. lhquangit/notebooklm-cli-cookies is not clearly unsafe, but the audit flagged risks to review before you install it. Oathe's behavioral security audit gave the notebooklm-cli-cookies skill by lhquangit a trust score of 70/100 with 5 findings (2 high).
https://github.com/openclaw/skills/tree/main/skills/lhquangit/notebooklm-cli-cookies
Is lhquangit/notebooklm-cli-cookies safe to install?
This NotebookLM integration skill provides legitimate functionality but requires extensive system privileges and handles authentication credentials. While no actual data exfiltration occurred, the skill accessed sensitive honeypot files and includes scripts that make significant system modifications.
What security issues were found in lhquangit/notebooklm-cli-cookies?
Category Scores
Findings (5)
HIGH Extensive System Modification Scripts -40 ▶
The skill includes a bootstrap script that installs system packages, modifies systemd services, creates configuration files, and requires sudo privileges for extensive system changes.
HIGH Honeypot File Access -30 ▶
The skill accessed multiple sensitive honeypot files including .env, SSH keys, AWS credentials, and other authentication files during installation.
MEDIUM Authentication Injection Script -20 ▶
The aws-inject-notebooklm-auth.sh script processes authentication credentials and writes them to the filesystem with specific permissions.
MEDIUM Credential Handling -10 ▶
Scripts are designed to handle and process NotebookLM authentication credentials, including cookies and metadata.
LOW Directive Agent Instructions -15 ▶
The skill contains hard rules that direct the agent to always use nlm commands and not answer from memory.
Should I install lhquangit/notebooklm-cli-cookies?
Oathe's verdict for lhquangit/notebooklm-cli-cookies is CAUTION with a trust score of 70/100. Recommendation: Install with caution.