notebooklm

Pass

Audited by Gen Agent Trust Hub on Sep 8, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes subprocess.run in scripts/run.py, scripts/setup_environment.py, and scripts/__init__.py to automate its environment setup and to orchestrate the execution of its modular Python scripts.
  • Evidence: Commands are used to execute pip install, patchright install, and to run internal scripts via the virtual environment's Python interpreter.
  • [EXTERNAL_DOWNLOADS]: During the first-time setup, the skill downloads official Python packages from PyPI and browser binaries (Chrome/Chromium) as required by the patchright library for browser automation.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data by design, as it retrieves text content from external Google NotebookLM notebooks to provide grounded answers to the AI agent.
  • Ingestion Point: scripts/ask_question.py reads inner text from the browser's DOM after navigating to a user-specified NotebookLM URL.
  • Boundary Markers: The instructions explicitly frame the retrieved content as 'source-grounded' documentation answers.
  • Capability: The skill has the capability to write to local storage (for library and session management) and perform network operations via browser automation.
  • Sanitization: No specific text sanitization is performed on the notebook content before it is passed to the LLM, which is standard for RAG-style tools.
  • [DYNAMIC_EXECUTION]: The skill employs a wrapper script (scripts/run.py) that dynamically determines the correct path for the local Python interpreter and executes the skill's own modules based on command-line arguments provided by the agent.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 8, 2026, 08:02 AM