nlm-skill

SUSPICIOUS: the skill is largely coherent with its stated NotebookLM automation purpose, but it relies on a non-official third-party CLI/MCP that extracts and stores Google session cookies, routes actions through that tool, and can install/update other skills. This is not confirmed malware, but the credential mediation and transitive install footprint make it high risk.