notebooklm-hub

Pass

Audited by Gen Agent Trust Hub on May 18, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides instructions for the agent to execute specific local commands, including notebooklm-mcp-auth and a TypeScript script located at a hardcoded path (/Users/shaifriedman/superseller/tools/seed-notebooklm-session.ts) using npx tsx. These operations are part of the intended authentication and session management workflow.
  • [EXTERNAL_DOWNLOADS]: The skill interacts with an external API proxy hosted at worker.superseller.agency. This domain is associated with the skill's author and serves as a legitimate endpoint for routing NotebookLM queries and managing authentication cookies.
  • [PROMPT_INJECTION]: The skill ingests untrusted data from external NotebookLM notebooks, creating an indirect prompt injection attack surface.
  • Ingestion points: Content retrieved through the mcp__notebooklm__query tool in SKILL.md.
  • Boundary markers: Absent; there are no specific delimiters or instructions to treat the retrieved content as untrusted.
  • Capability inventory: The skill enables reading, summarizing, and listing notebooks. Other system capabilities depend on the host agent's broader environment.
  • Sanitization: No validation or sanitization of the notebook response content is mentioned before it is processed by the agent.
Audit Metadata
Risk Level
SAFE
Analyzed
May 18, 2026, 05:37 AM