notebooklm

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). The skill's required workflow (SKILL.md/README and scripts/ask_question.py) programmatically opens and scrapes NotebookLM pages at https://notebooklm.google.com (user-shared notebooks and linked public content), ingests those user-provided/untrusted documents' answers, and uses them to drive follow-up queries and synthesis, so third-party content can materially influence agent behavior.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill launches a browser at runtime and programmatically navigates to NotebookLM (e.g. https://notebooklm.google.com/notebook/...) to scrape NotebookLM/Gemini responses which are then returned and injected into the agent’s output flow, so external notebook content fetched at runtime directly controls the agent's responses.