notebook-research

SUSPICIOUS: the skill is purpose-aligned and uses a verifiable PyPI package, but its real footprint depends on an unofficial personal-project CLI/MCP server that handles Google NotebookLM authentication via browser cookie extraction and undocumented internal APIs. That makes the install trust and credential/data flow risk disproportionate compared with an official direct integration, even though there is no confirmed malware or overt exfiltration.