blog-notebooklm

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). Most links are legitimate (NotebookLM and a Microsoft Playwright issue) or invalid, but the GitHub repo "Kaliiiiiiiiii-Vinyzu/patchright-python" is an odd/unknown fork referenced for anti-detection tooling (a red flag for potentially modified/tainted binaries), so the set is moderately high risk overall.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required runtime path for /blog notebooklm ask is scripts/ask_question.py -> ask_notebooklm() -> page.goto(notebook_url), where the agent reads NotebookLM’s rendered bot response text from the page DOM (inner_text() of .to-user-container .message-text-content / assistant selectors), which is outsider-authored free text originating from Google NotebookLM (not the operating user’s chosen documents/prompts).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly navigates at runtime to the NotebookLM notebook URL (e.g. https://notebooklm.google.com/notebook/...) and uses the remote notebook content to produce source-grounded answers, so fetched external content directly controls the agent's outputs and is a required runtime dependency.