notebooklm-research
Pass
Audited by Gen Agent Trust Hub on Apr 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
subprocess.runto interact with system tools and internal CLI components. - Found in
scripts/auth_helper.pyexecutingnotebooklm loginto handle Google authentication via Chromium. - Found in
scripts/pipeline.pycallingtrend-pulse(a vendor-owned resource) to fetch trending topics. - Found in
scripts/make_video.shwhich orchestratesffmpegandpdftoppmto convert research slides and audio into MP4 videos. - [EXTERNAL_DOWNLOADS]: The skill inherently performs network operations to interact with Google NotebookLM services and ingest external content.
- Fetches data from user-provided URLs (articles, YouTube, PDFs).
- Uses
httpxandfeedparserto retrieve and parse RSS feeds for batch digestion. - Downloads generated research artifacts such as M4A audio, MP4 videos, and PDF slide decks from Google's infrastructure.
- [DATA_EXFILTRATION]: The skill accesses sensitive session information stored locally at
~/.notebooklm/storage_state.json. - This file contains Google authentication cookies and tokens required for the skill to operate on behalf of the user within NotebookLM. This behavior is documented and central to the skill's primary function as an automated research agent.
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface through its core data ingestion capabilities.
- It processes untrusted external content from URLs, PDFs, and transcripts, which is then used as context for research queries processed by both NotebookLM and Claude. Boundary markers are not explicitly mentioned in the scripts, posing a low risk of the agent obeying instructions embedded in the source material.
Audit Metadata