notebooklm

Warn

Audited by Socket on Oct 7, 2026

1 alert found:

Security
SecurityMEDIUM
scripts/nlm-generate.sh

This is a CLI wrapper for NotebookLM artifact generation. It contains a command-injection vulnerability because user-supplied notebook IDs and report formats are interpolated into a string passed to eval. Avoid eval and pass arguments directly to the CLI. The counter increments also cause premature termination under set -e. The fragment does not show independent malicious behavior or data theft.

Confidence: 99%Severity: 78%
Audit Metadata
Analyzed At
Oct 7, 2026, 06:28 PM
Package URL
pkg:socket/skills-sh/jmagar%2Fclaude-homelab%2Fnotebooklm%2F@9218796d678033baaff47b20a64f64617ae3b8e4cdd96d3f3b0f3969bca4f7f0