notebooklm
Pass
Audited by Gen Agent Trust Hub on Mar 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
subprocess.runto manage its environment and execute local scripts. Specifically,scripts/run.pyandscripts/setup_environment.pyinvoke the Python interpreter and shell commands to set up a virtual environment and run automation tasks.- [EXTERNAL_DOWNLOADS]: The skill triggers the download and installation of external dependencies. It fetches Python packages from PyPI and the Google Chrome browser through thepatchrightlibrary during its first-run setup.- [PROMPT_INJECTION]: The skill implements a follow-up mechanism by appending specific instructions to the responses fetched from NotebookLM. This 'FOLLOW_UP_REMINDER' inscripts/ask_question.pydirects the agent to evaluate the completeness of the answer and potentially perform additional queries, which influences the agent's decision-making flow.- [PROMPT_INJECTION]: The skill processes unstructured text from Google NotebookLM, creating an indirect prompt injection surface. - Ingestion points: Text is extracted from the browser in
scripts/ask_question.py(lines 104-142). - Boundary markers: Absent. The content is returned to the agent without specific delimiters or warnings to ignore embedded instructions.
- Capability inventory: The skill can execute local Python scripts and shell commands via
subprocesscalls inscripts/run.py. - Sanitization: Absent. The content is retrieved and returned in its raw text form.
Audit Metadata