notebooklm

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). The skill explicitly ingests open web and user-generated content (e.g., "notebooklm source add 'https://...'", "source add-research 'query' --mode deep", and YouTube URLs) as shown in SKILL.md and the README/Common Workflows, and then the agent is expected to chat with and generate artifacts from that indexed content—so untrusted third-party pages can be fetched and materially influence tool actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The README includes runtime installation commands that fetch and execute remote code (curl https://api.github.com/repos/teng-lin/notebooklm-py/releases/latest and pip install git+https://github.com/teng-lin/notebooklm-py@), which the skill depends on, so these GitHub URLs pose a high risk of executing external code.