nlm-skill

SUSPICIOUS: The skill’s capabilities fit its stated NotebookLM automation purpose, and the tooling appears publicly distributed and verifiable. However, it relies on unofficial third-party CLI/MCP software that authenticates via browser cookie extraction and internal APIs rather than an official Google API, creating meaningful credential and data-handling risk disproportionate to a low-risk documentation skill.