nlm-skill

Pass

Audited by Gen Agent Trust Hub on Aug 18, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill facilitates complex automation workflows using the nlm command-line interface and associated MCP tools. These commands allow the agent to manage notebooks, query sources, and trigger content generation pipelines.
  • [EXTERNAL_DOWNLOADS]: The skill recommends the installation of the notebooklm-mcp-cli tool using uv tool install. This package is the primary dependency for the skill and is provided by the vendor jacob-bd (AGENTS_SECTION.md).
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted content from external web URLs, YouTube videos, and Google Drive documents, which creates a potential surface for indirect prompt injection attacks.
  • Ingestion points: Data enters the system via source_add (MCP) or nlm source add (CLI) from various external providers (SKILL.md, Workflow 2).
  • Boundary markers: The skill documentation explicitly instructs agents to include a "grounding anchor" in prompts to restrict the LLM to source-only content: "Use only uploaded sources. Do not invent statistics, quotes, names, or examples not in the sources" (references/studio-prompting-guide.md).
  • Capability inventory: The skill has the capability to execute shell commands, perform network requests to fetch source data, and trigger LLM-based generation via Studio tools (multiple files).
  • Sanitization: The skill relies on grounding instructions and mandatory user confirmation gates (confirm=True / --confirm) for all generation and deletion tasks rather than programmatic sanitization of the input data (SKILL.md, Workflow 15).
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 18, 2026, 03:25 PM
Security Audit — agent-trust-hub — nlm-skill