notebooklm-mcp-programmatic-access
Warn
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: MEDIUMCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSPERSISTENCECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The nlm login command automatically extracts authentication cookies from the user's web browser to facilitate access to Google NotebookLM. This method involves high-risk access to sensitive session data and browser credentials.\n- [EXTERNAL_DOWNLOADS]: The skill requires installing the notebooklm-mcp-cli package via uv, pip, or pipx. This is a third-party utility and is not an official tool provided by Google.\n- [PERSISTENCE]: The skill includes tools (nlm setup add) that automatically modify the configuration files of various AI applications, including Claude Desktop, Cursor, and GitHub Copilot. These changes are persistent across application sessions and involve writing to application-specific JSON configuration files.\n- [COMMAND_EXECUTION]: The skill provides numerous examples and tools for executing shell commands and subprocesses via the nlm CLI for notebook management, research pipelines, and batch processing.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external URLs and Google Drive documents, creating a surface for indirect prompt injection attacks.\n
- Ingestion points: source_add tool and nlm source add --url command documented in SKILL.md.\n
- Boundary markers: The skill does not document any boundary markers or instructions to the AI agent to ignore potentially malicious instructions embedded in the ingested sources.\n
- Capability inventory: The skill possesses capabilities to write files (download_artifact), modify system/application configurations (nlm setup add), and perform network operations (notebook_query, research_start).\n
- Sanitization: There is no evidence of sanitization or content filtering for external data added to the notebooks.
Audit Metadata