@roomi-fields/notebooklm-mcp has a path traversal in vault.batch tool that allows arbitrary file write outside intended vault directory

Summary The vaultbatch MCP tool and the equivalent POST /batch-to-vault HTTP endpoint accepted a caller-supplied vaultdir path that was passed directly to path.resolve + fs.mkdir with no containment check. A caller — or a prompt-injected LLM driving the MCP — could therefore create directories an...