notebooklm

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly accepts and ingests arbitrary public URLs and YouTube/website sources (see scripts/add_source.py --url and the SKILL.md "Add to your library" / "URL Sources" sections), then reads and uses those NotebookLM-ingested source contents via ask_question.py and the SourceFilter to select sources and drive follow-up actions, so untrusted third-party content can materially influence agent behavior and enable indirect prompt injection.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The add_source.py runtime flow pastes user-provided website/YouTube URLs into NotebookLM (e.g., the documented test URL https://en.wikipedia.org/wiki/Meiji_Restoration), causing remote content fetched at runtime to be ingested into the model context and directly influence agent outputs.