notebooklm
Fail
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: HIGHCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The README provides instructions for the user to download and execute a shell script from bun.sh to install the Bun runtime.- [COMMAND_EXECUTION]: The core logic in scripts/notebooklm.ts utilizes Bun.spawn to invoke the agent-browser CLI, enabling the skill to programmatically control a web browser for authentication and notebook querying.- [DATA_EXFILTRATION]: The skill accesses sensitive browser profiles located in the user's home directory (~/.profiles/) to maintain persistent Google authentication. It also manages local data files in the .data/ directory to store authentication timestamps and notebook metadata.- [PROMPT_INJECTION]: The skill defines a follow-up mechanism in SKILL.md that instructs the agent to analyze responses and perform iterative queries if information gaps are identified. This includes appending a specific reminder to all answers to influence the agent's reasoning process.- [DATA_EXFILTRATION]: The skill retrieves and processes data from notebooklm.google.com, which is then integrated into the agent's context. This interaction with external, untrusted content creates a potential surface for indirect prompt injection if the source notebooks contain malicious instructions.
Recommendations
- HIGH: Downloads and executes remote code from: https://bun.sh/install - DO NOT USE without thorough review
Audit Metadata