notebooklm-research

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required runtime workflow can ingest outsider-authored free text into the agent’s LLM context via add-source --url/--youtube (public web pages/videos) and add-source --text (user-supplied pasted text from others), which NotebookLM then uses to generate query answers and citations that are returned to the agent as readable text.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). This skill, via the add-source --url CLI (e.g., the example URL "https://example.com"), will at runtime submit arbitrary external web pages to NotebookLM which are fetched/ingested and thus directly control the model's context/prompts and outputs.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (medium risk: 0.50). The skill instructs automating and controlling a real Chrome profile via CDP and explicitly recommends tactics (reuse of persistent profiles and human-like typing/delays) to evade Google’s bot detection, which is guidance to circumvent security mechanisms even though it does not request sudo, system-file modification, or user creation.