notebooklm-mcp

SUSPICIOUS: the skill is internally coherent for NotebookLM access, but its actual footprint is high-trust and disproportionate because it depends on an unofficial third-party client that authenticates by ingesting full Google session cookies. Pinned PyPI distribution and provenance reduce supply-chain concern, but credential sensitivity, browser-cookie extraction, and third-party session handling keep overall risk elevated.