notebooklm
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes
subprocess.runinscripts/run.py,scripts/setup_environment.py, andscripts/__init__.pyto automate its environment setup and to orchestrate the execution of its modular Python scripts. - Evidence: Commands are used to execute
pip install,patchright install, and to run internal scripts via the virtual environment's Python interpreter. - [EXTERNAL_DOWNLOADS]: During the first-time setup, the skill downloads official Python packages from PyPI and browser binaries (Chrome/Chromium) as required by the
patchrightlibrary for browser automation. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data by design, as it retrieves text content from external Google NotebookLM notebooks to provide grounded answers to the AI agent.
- Ingestion Point:
scripts/ask_question.pyreads inner text from the browser's DOM after navigating to a user-specified NotebookLM URL. - Boundary Markers: The instructions explicitly frame the retrieved content as 'source-grounded' documentation answers.
- Capability: The skill has the capability to write to local storage (for library and session management) and perform network operations via browser automation.
- Sanitization: No specific text sanitization is performed on the notebook content before it is passed to the LLM, which is standard for RAG-style tools.
- [DYNAMIC_EXECUTION]: The skill employs a wrapper script (
scripts/run.py) that dynamically determines the correct path for the local Python interpreter and executes the skill's own modules based on command-line arguments provided by the agent.
Audit Metadata