notebooklm

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). These URLs point to individual GitHub repositories that require cloning/running code locally (including a .git clone and an npx install), which are unverified distribution channels that can deliver malware; the notebooklm.google.com link itself is an official Google domain and not flagged.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's installation instructions fetch and install remote code (git clone https://github.com/PleasePrompto/notebooklm-skill.git and the npx installer at https://github.com/akillness/jeo-skills) which is then executed via local Python scripts (e.g., python scripts/run.py), so these URLs constitute runtime external dependencies that deliver executable code.