notebooklm-research

Pass

Audited by Gen Agent Trust Hub on Apr 1, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses subprocess.run to interact with system tools and internal CLI components.
  • Found in scripts/auth_helper.py executing notebooklm login to handle Google authentication via Chromium.
  • Found in scripts/pipeline.py calling trend-pulse (a vendor-owned resource) to fetch trending topics.
  • Found in scripts/make_video.sh which orchestrates ffmpeg and pdftoppm to convert research slides and audio into MP4 videos.
  • [EXTERNAL_DOWNLOADS]: The skill inherently performs network operations to interact with Google NotebookLM services and ingest external content.
  • Fetches data from user-provided URLs (articles, YouTube, PDFs).
  • Uses httpx and feedparser to retrieve and parse RSS feeds for batch digestion.
  • Downloads generated research artifacts such as M4A audio, MP4 videos, and PDF slide decks from Google's infrastructure.
  • [DATA_EXFILTRATION]: The skill accesses sensitive session information stored locally at ~/.notebooklm/storage_state.json.
  • This file contains Google authentication cookies and tokens required for the skill to operate on behalf of the user within NotebookLM. This behavior is documented and central to the skill's primary function as an automated research agent.
  • [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface through its core data ingestion capabilities.
  • It processes untrusted external content from URLs, PDFs, and transcripts, which is then used as context for research queries processed by both NotebookLM and Claude. Boundary markers are not explicitly mentioned in the scripts, posing a low risk of the agent obeying instructions embedded in the source material.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 1, 2026, 08:04 AM