notebooklm
Fail
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The installation script (
scripts/install.sh) manages the setup of external dependencies and provides user instructions for environment configuration.\n - The script automates the installation of the
notebooklm-mcp-clipackage usinguv,pipx, orpip.\n - It includes an instructional message for the manual installation of the
uvtool from its official domain (astral.sh) using a piped shell command:curl -LsSf https://astral.sh/uv/install.sh | sh.\n- [EXTERNAL_DOWNLOADS]: The skill fetches software from external repositories to enable its core functionality.\n - Downloads the
notebooklm-mcp-clipackage from the Python Package Index (PyPI).\n - References the official GitHub repository
https://github.com/jacob-bd/notebooklm-mcp-clifor underlying tool documentation and updates.\n- [COMMAND_EXECUTION]: The skill relies on executing thenlmcommand-line interface to interact with Google services.\n - Commands include
nlm login, which facilitates authentication by interacting with browser profiles to manage session cookies stored locally in~/.notebooklm-mcp-cli.\n- [INDIRECT_PROMPT_INJECTION]: The skill has a surface for indirect prompt injection as it processes content from untrusted external sources.\n - Ingestion points: The agent ingests data from external URLs, YouTube video transcripts, local files (PDF, DOCX, TXT), and Google Drive documents via the
nlm source addandnlm research startcommands as defined inSKILL.md.\n - Boundary markers: The skill instructions do not provide specific delimiters or safety warnings to distinguish between user instructions and ingested content.\n
- Capability inventory: The skill can perform network operations, read local files, and execute shell commands through the
nlmCLI.\n - Sanitization: No explicit sanitization or filtering of external content is performed within the skill scripts; the skill relies on the underlying CLI tool and service-side protections.
Recommendations
- HIGH: Downloads and executes remote code from: https://astral.sh/uv/install.sh - DO NOT USE without thorough review
Audit Metadata