notebooklm-mcp
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONPERSISTENCEINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill facilitates the execution of local binaries including the
nlmCLI andnotebooklm-mcpserver to interact with Google NotebookLM services. It also utilizes shell scripts for environment verification and configuration. - [DYNAMIC_EXECUTION]: The script
scripts/setup_notebooklm_mcp.shexecutes an embedded Python script via stdin to perform structured JSON patching of agent configuration files. This method is used to ensure cross-platform compatibility without requiring external JSON manipulation tools. - [PERSISTENCE]: The skill provides automated configuration utilities that modify persistent agent configuration files (such as
~/.claude.json,~/.cursor/mcp.json, and other platform-specific paths) to ensure the NotebookLM MCP server is registered and available across sessions. This is standard behavior for MCP-native skills. - [INDIRECT_PROMPT_INJECTION]: The skill provides an interface to ingest and process external data from Google NotebookLM, which serves as a potential vector for indirect prompt injection.
- Ingestion points: Data is retrieved from NotebookLM notebooks, source documents, and chat history via the tool's CLI and MCP interfaces as described in
SKILL.mdandreferences/auth-guide.md. - Boundary markers: The instructions do not define specific delimiters or 'ignore' instructions for the data ingested from NotebookLM.
- Capability inventory: The skill possesses the capability to execute shell commands (
nlm), write to local configuration files (scripts/setup_notebooklm_mcp.sh), and perform network operations via thenlmbinary. - Sanitization: No explicit sanitization or filtering of the content retrieved from Google services is implemented before it is presented to the agent context.
Audit Metadata