podcast-maker

SUSPICIOUS: The skill’s purpose is coherent, and the media-generation steps are proportionate, but its trust model is weak. The main risk is reliance on an unofficial, ambiguously specified NotebookLM CLI/MCP that handles Google authentication and content submission without clear same-org provenance or version pinning; this raises medium supply-chain and credential-handling concerns, though there is no direct evidence of malicious exfiltration or exploit behavior in the skill text itself.