nlm-skill
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill facilitates complex automation workflows using the
nlmcommand-line interface and associated MCP tools. These commands allow the agent to manage notebooks, query sources, and trigger content generation pipelines. - [EXTERNAL_DOWNLOADS]: The skill recommends the installation of the
notebooklm-mcp-clitool usinguv tool install. This package is the primary dependency for the skill and is provided by the vendorjacob-bd(AGENTS_SECTION.md). - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted content from external web URLs, YouTube videos, and Google Drive documents, which creates a potential surface for indirect prompt injection attacks.
- Ingestion points: Data enters the system via
source_add(MCP) ornlm source add(CLI) from various external providers (SKILL.md, Workflow 2). - Boundary markers: The skill documentation explicitly instructs agents to include a "grounding anchor" in prompts to restrict the LLM to source-only content: "Use only uploaded sources. Do not invent statistics, quotes, names, or examples not in the sources" (references/studio-prompting-guide.md).
- Capability inventory: The skill has the capability to execute shell commands, perform network requests to fetch source data, and trigger LLM-based generation via Studio tools (multiple files).
- Sanitization: The skill relies on grounding instructions and mandatory user confirmation gates (
confirm=True/--confirm) for all generation and deletion tasks rather than programmatic sanitization of the input data (SKILL.md, Workflow 15).
Audit Metadata