anything-to-notebooklm
Fail
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS] (HIGH): The installation script clones a repository from an untrusted GitHub user ('Bwkyd/wexin-read-mcp'). This repository is not part of the trusted organization list and its contents are executed as an MCP server.
- Evidence: 'git clone https://github.com/Bwkyd/wexin-read-mcp.git' in install.sh.
- [EXTERNAL_DOWNLOADS] (HIGH): The skill installs a Python package directly from an untrusted GitHub repository ('teng-lin/notebooklm-py').
- Evidence: 'pip3 install git+https://github.com/teng-lin/notebooklm-py.git' in install.sh.
- [DATA_EXPOSURE] (LOW): The environment check script reads the sensitive local Claude configuration file located at ~/.claude/config.json. While it only checks for a specific configuration key, this file often contains API keys and private configuration.
- Evidence: 'config_path = Path.home() / ".claude" / "config.json"' in check_env.py.
- [COMMAND_EXECUTION] (MEDIUM): The check_env.py script uses the subprocess module to execute external binaries like 'notebooklm' and 'git' to verify their presence and versions.
- Evidence: 'subprocess.run([cmd, "--version"]...)' and 'subprocess.run(["notebooklm", "list"]...)' in check_env.py.
- [INDIRECT_PROMPT_INJECTION] (LOW): The skill possesses a surface for indirect prompt injection as it is designed to ingest data from external untrusted sources like WeChat articles and convert them via markitdown.
- Ingestion points: External content processed by the 'wexin-read-mcp' server.
- Boundary markers: None identified in the provided scripts to delimit untrusted content.
- Capability inventory: Shell command execution via subprocess and network access for content retrieval.
- Sanitization: No sanitization or validation of the ingested external content is performed within these scripts.
Recommendations
- AI detected serious security threats
Audit Metadata