notebooklm
Pass
Audited by Gen Agent Trust Hub on Jun 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill utilizes the
uvxpackage runner to download and executenotebooklm-mcp-clifrom external registries. The package is not pinned to a specific version, allowing the tool to fetch any version at runtime.\n- [COMMAND_EXECUTION]: The instructions direct the agent to execute shell commands using thenlmCLI for notebook operations, status polling, and artifact generation.\n- [DATA_EXFILTRATION]: The skill facilitates the transfer of local text, Google Drive IDs, and external URLs to the Google NotebookLM service. This behavior is consistent with the primary functionality described in the skill metadata.\n- [PROMPT_INJECTION]: The skill processes untrusted external data, creating an indirect prompt injection attack surface.\n - Ingestion points: External content is added to notebooks via the
source addcommand using the--url,--text, or--driveparameters (identified in SKILL.md and references/workflows.md).\n - Boundary markers: The instructions do not define delimiters or specific isolation protocols for the ingested content.\n
- Capability inventory: The skill allows the agent to execute system commands, create artifacts, and query data from a source-specific workspace.\n
- Sanitization: There is no mention of sanitization or safety filtering applied to the imported content before it is processed by the agent.
Audit Metadata