notebooklm

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Outsider-authored free text is ingested at runtime when the user supplies a --question (and optionally a --notebook-url) that ask_question.py types into the NotebookLM web UI, and the assistant then reads the resulting assistant/bot response text from the page selectors.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill opens user-supplied NotebookLM URLs at runtime (e.g., https://notebooklm.google.com/notebook/...), navigates to those pages and extracts response text which is injected into the agent flow, so remote content fetched during runtime can directly influence agent prompts/responses.