notebooklm

Fail

Audited by Gen Agent Trust Hub on Oct 7, 2026

Risk Level: HIGHREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The installation script (scripts/install.sh) manages the setup of external dependencies and provides user instructions for environment configuration.\n
  • The script automates the installation of the notebooklm-mcp-cli package using uv, pipx, or pip.\n
  • It includes an instructional message for the manual installation of the uv tool from its official domain (astral.sh) using a piped shell command: curl -LsSf https://astral.sh/uv/install.sh | sh.\n- [EXTERNAL_DOWNLOADS]: The skill fetches software from external repositories to enable its core functionality.\n
  • Downloads the notebooklm-mcp-cli package from the Python Package Index (PyPI).\n
  • References the official GitHub repository https://github.com/jacob-bd/notebooklm-mcp-cli for underlying tool documentation and updates.\n- [COMMAND_EXECUTION]: The skill relies on executing the nlm command-line interface to interact with Google services.\n
  • Commands include nlm login, which facilitates authentication by interacting with browser profiles to manage session cookies stored locally in ~/.notebooklm-mcp-cli.\n- [INDIRECT_PROMPT_INJECTION]: The skill has a surface for indirect prompt injection as it processes content from untrusted external sources.\n
  • Ingestion points: The agent ingests data from external URLs, YouTube video transcripts, local files (PDF, DOCX, TXT), and Google Drive documents via the nlm source add and nlm research start commands as defined in SKILL.md.\n
  • Boundary markers: The skill instructions do not provide specific delimiters or safety warnings to distinguish between user instructions and ingested content.\n
  • Capability inventory: The skill can perform network operations, read local files, and execute shell commands through the nlm CLI.\n
  • Sanitization: No explicit sanitization or filtering of external content is performed within the skill scripts; the skill relies on the underlying CLI tool and service-side protections.
Recommendations
  • HIGH: Downloads and executes remote code from: https://astral.sh/uv/install.sh - DO NOT USE without thorough review
Audit Metadata
Risk Level
HIGH
Analyzed
Oct 7, 2026, 07:27 PM