Skills notebooklm
📦

notebooklm

Content revision r2 High Risk 📁 Filesystem access🌐 Network access🔑 Env variables⚙️ External commands

Query NotebookLM From Your AI Assistant

Research across uploaded documents can require repeated browser switching. This skill lets Claude, Codex, and Claude Code query NotebookLM through local browser automation.

Supports: Claude Codex Code(CC)
⚠️ 38 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "notebooklm" from https://skillstore.io/skills/sickn33-notebooklm.md and its manifest at https://skillstore.io/api/skills/sickn33-notebooklm/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/sickn33-notebooklm.md Signed manifest GET /api/skills/sickn33-notebooklm/manifest Signed lockfile GET /api/skills/sickn33-notebooklm/lockfile

Test it

Using "notebooklm". Ask my API notebook which authentication flow is required.

Expected outcome:

The notebook describes the required authentication flow, summarizes each step, and notes any conditions or uncertainties found in the uploaded sources.

Using "notebooklm". Show my saved notebooks.

Expected outcome:

  • Product API Reference, active, topics: authentication and endpoints.
  • Operations Handbook, topics: deployment and incident response.

Using "notebooklm". Compare the maintenance intervals in my equipment notebook.

Expected outcome:

The answer compares each documented interval, highlights conflicting source statements, and separates explicit guidance from missing information.

Security Audit

High Risk
v6 • 8/4/2026 Open versioned report

The skill performs legitimate NotebookLM research automation, and most static matches are documentation or fixed commands. Confirmed risks include behavior-steering prompt injection, anti-detection automation, persistent Google session cookies, unsafe URL navigation with a disabled browser sandbox, automatic installers, and an arbitrary local Python execution path.

20
Files scanned
4,212
Lines analyzed
9
Review items
0
False positives ignored

Confirmed security concerns (4)

High
README.md:200
System reconnaissance
Uses realistic typing speeds and interaction patterns to avoid detection.
The documentation explicitly says human-like interaction is used to avoid detection. This confirms deliberate evasion of Google's automation controls, not ordinary system reconnaissance.
High
scripts/ask_question.py:29-36SKILL.md:131-144
Prompt Injection Attempt Detected
The script appends "EXTREMELY IMPORTANT: Is that ALL you need to know?" and instructions to review the user request and ask again. This tool-output text directs the host agent's behavior and can force extra external queries before the user receives a response.
The behavior-steering text is defined in code, appended to every retrieved answer, and reinforced by explicit agent instructions in SKILL.md.
High
scripts/auth_manager.py:173-179scripts/browser_utils.py:46-53
Persistent Google Session Credentials
The skill saves complete browser storage state and later reinjects its cookies into a persistent Chrome context. Theft or unintended disclosure of this local state can enable Google session hijacking.
The code explicitly serializes browser cookies and local storage, applies restrictive permissions, and reloads the cookies for later authenticated sessions.
High
scripts/config.py:60-66scripts/ask_question.py:74-80scripts/notebook_manager.py:314-319
Unvalidated Browser Navigation Without Sandbox
A user-provided or library-stored URL is opened before its host is validated, while Chrome is launched with --no-sandbox. This permits arbitrary browser navigation and increases the impact of malicious web content.
The CLI accepts any URL, stores it without origin validation, navigates to it, and only afterward waits for the NotebookLM origin while the browser sandbox is disabled.
Capability review items (9)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High
scripts/__init__.py:53
Python subprocess.run
subprocess.run(
Importing the scripts package can invoke pip automatically to download and execute dependencies. Network package installation as an import side effect creates supply-chain and unexpected-execution risk.
High
scripts/__init__.py:65
Python subprocess.run
subprocess.run(
Importing the package can automatically run Patchright's browser installer. This downloads and executes browser setup without a separate user confirmation step.
High
scripts/setup_environment.py:54
Python subprocess.run
subprocess.run(
First-run setup automatically upgrades pip from the network. This executes newly downloaded package-management code and mutates the environment without a dedicated confirmation.
High
scripts/setup_environment.py:62
Python subprocess.run
result = subprocess.run(
First-run setup automatically installs third-party requirements from the network. Version pins reduce drift but do not remove package-index or supply-chain execution risk.
High
scripts/setup_environment.py:75
Python subprocess.run
subprocess.run(
The setup automatically invokes Patchright to download and install Chrome assets. This is a significant external side effect performed during automatic bootstrap.
High
scripts/setup_environment.py:132
Python subprocess.run
result = subprocess.run(cmd)
The --run value is joined into a script path without an allowlist or resolved-path containment check, then executed by Python. A traversal value can execute an arbitrary existing local Python file.
Medium
scripts/auth_manager.py:219
Python shutil operations
shutil.rmtree(self.browser_state_dir)
clear_auth recursively deletes the browser-state directory, whose base path can be selected through AAS_NOTEBOOKLM_DATA_DIR. The command is intentional but lacks a containment check before destructive deletion.
Medium
scripts/config.py:32
Python shutil operations
shutil.move(str(LEGACY_DATA_DIR), str(DATA_DIR))
Sensitive legacy state is moved to DATA_DIR, which can be selected by an environment variable. An untrusted environment can redirect this migration to an unintended filesystem location.
Medium
scripts/config.py:12
Python environment access
DATA_DIR = Path(os.environ.get(
AAS_NOTEBOOKLM_DATA_DIR controls where live browser credentials are stored and which browser-state tree can later be deleted. The value is expanded without validating it against an approved application directory.

Risk Factors

📁 Filesystem access (50)
AUTHENTICATION.md:101 AUTHENTICATION.md:101 README.md:73 README.md:76 README.md:154 README.md:163 README.md:266 README.md:268 README.md:334 README.md:347 README.md:400 README.md:73 README.md:76 README.md:154 README.md:163 README.md:266 README.md:268 README.md:334 README.md:347 README.md:400 references/api_reference.md:185 references/api_reference.md:185 references/troubleshooting.md:101 references/troubleshooting.md:223 references/troubleshooting.md:226 references/troubleshooting.md:236 references/troubleshooting.md:282 references/troubleshooting.md:283 references/troubleshooting.md:287 references/troubleshooting.md:298 references/troubleshooting.md:299 references/troubleshooting.md:306 references/troubleshooting.md:353 references/troubleshooting.md:361 references/troubleshooting.md:101 references/troubleshooting.md:223 references/troubleshooting.md:226 references/troubleshooting.md:236 references/troubleshooting.md:282 references/troubleshooting.md:283 references/troubleshooting.md:287 references/troubleshooting.md:298 references/troubleshooting.md:299 references/troubleshooting.md:306 references/troubleshooting.md:353 references/troubleshooting.md:361 scripts/auth_manager.py:191 scripts/auth_manager.py:219 scripts/cleanup_manager.py:173 scripts/config.py:32
🌐 Network access (21)
README.md:77 README.md:401 references/api_reference.md:30 references/api_reference.md:52 references/api_reference.md:59 references/troubleshooting.md:148 references/troubleshooting.md:209 references/troubleshooting.md:210 references/troubleshooting.md:209 references/troubleshooting.md:210 references/usage_patterns.md:31 scripts/ask_question.py:9 scripts/ask_question.py:80 scripts/auth_manager.py:10 scripts/auth_manager.py:127 scripts/auth_manager.py:142 scripts/auth_manager.py:276 scripts/setup_environment.py:72 SKILL.md:17 SKILL.md:96 SKILL.md:125
🔑 Env variables (3)
README.md:258 requirements.txt:10 scripts/config.py:12
⚙️ External commands (50)
references/api_reference.md:160 references/api_reference.md:216 references/api_reference.md:228 references/api_reference.md:249 references/api_reference.md:271 references/troubleshooting.md:132 references/troubleshooting.md:277 references/usage_patterns.md:177 references/usage_patterns.md:210 references/usage_patterns.md:219 references/usage_patterns.md:143 scripts/__init__.py:53 scripts/__init__.py:65 scripts/run.py:48 scripts/run.py:107 scripts/setup_environment.py:54 scripts/setup_environment.py:62 scripts/setup_environment.py:75 scripts/setup_environment.py:132 SKILL.md:17 SKILL.md:27-33 SKILL.md:33-36 SKILL.md:36-37 SKILL.md:37-38 SKILL.md:38-39 SKILL.md:39-45 SKILL.md:45-47 SKILL.md:47-55 SKILL.md:55-57 SKILL.md:57-58 SKILL.md:58-66 SKILL.md:66-68 SKILL.md:68-73 SKILL.md:73-76 SKILL.md:76-86 SKILL.md:86-109 SKILL.md:109-112 SKILL.md:112-113 SKILL.md:113-117 SKILL.md:117-129 SKILL.md:129-140 SKILL.md:140-142 SKILL.md:142-148 SKILL.md:148-149 SKILL.md:149-154 SKILL.md:154-156 SKILL.md:156-157 SKILL.md:157-164 SKILL.md:164-166 SKILL.md:166-167

Detected Patterns

System reconnaissance
Audited by: codex View Audit History →
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/sickn33-notebooklm/audits/6?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/sickn33-notebooklm/security.svg)](https://skillstore.io/skills/sickn33-notebooklm?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/sickn33-notebooklm?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-notebooklm/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/sickn33-notebooklm.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA · BibTeX · CFF)

APA citation

sickn33. (2026). notebooklm security audit report (audit version 6) [Author version unspecified]. Skillstore. https://skillstore.io/skills/sickn33-notebooklm/audits/6

BibTeX citation

@techreport{sickn33-sickn33-notebooklm-2026, author = {sickn33}, title = {notebooklm security audit report (audit version 6)}, institution = {Skillstore}, year = {2026}, number = {6}, url = {https://skillstore.io/skills/sickn33-notebooklm/audits/6}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "notebooklm security audit report (audit version 6)" version: "unspecified" type: report authors: - name: "sickn33" date-released: "2026-08-04" url: "https://skillstore.io/skills/sickn33-notebooklm/audits/6" identifiers: - type: other value: "skillstore:sickn33-notebooklm:audit:6" description: "Skillstore immutable audit report identifier"

Compare variants

3 installable variants

Each author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.

Why this variant is first

Higher Skillstore usage
ZhanlinCui Recommended

zhanlincui-notebooklm

Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 36
Updated

2026-08-21

teng-lin

teng-lin-notebooklm

Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 17
Updated

2026-08-21

sickn33 Current

sickn33-notebooklm

Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 17
Updated

2026-08-21

Skillstore Score

Why this score Evidence Confidence: Medium
82
Architecture
85
Maintainability
87
Content
70
Community
83
Spec Compliance

What You Can Build

Check Technical Documentation

Ask implementation questions against uploaded product manuals, API guides, or internal engineering documents.

Synthesize Research Sources

Compare findings across papers, reports, and notes already organized in a NotebookLM notebook.

Retrieve Operational Guidance

Find policies, procedures, and exact specifications from a maintained organizational knowledge notebook.

Try These Prompts

List My Notebooks 
List my saved NotebookLM notebooks and show which notebook is active.
Ask One Source Question 
Ask my [notebook name] notebook: [specific question]. Return the answer with its source context.
Add and Describe a Notebook 
Query this NotebookLM link, summarize its scope, and add it with a clear name, description, and topic tags: [NotebookLM URL].
Compare Evidence Across Topics 
Use my [notebook name] notebook to compare [topic A] and [topic B]. Identify agreements, conflicts, missing evidence, and practical implications.

Best Practices

  • Use a dedicated Google account and protect the local browser-state directory.
  • Ask narrow questions that name the notebook, topic, and required level of detail.
  • Verify important claims against NotebookLM citations before acting on them.

Avoid

  • Do not provide notebook links from untrusted sources or unrelated domains.
  • Do not share, commit, or back up saved browser cookies to insecure locations.
  • Do not assume NotebookLM answers are complete when source documents lack evidence.

Frequently Asked Questions

Does this skill upload documents to NotebookLM?
No. Users create notebooks and upload sources through NotebookLM before querying them.
Does it require a Google account?
Yes. Authentication uses an interactive Chrome window and saves browser state for later queries.
Can it run in a hosted web sandbox?
Usually not. It requires local browser execution, network access, and interactive authentication.
Where is notebook metadata stored?
Notebook metadata is stored locally in a library file managed by the skill.
Are answers guaranteed to be accurate?
No. Answers depend on uploaded sources, NotebookLM retrieval, and the clarity of each question.
Can it maintain a continuous NotebookLM conversation?
No. The main question flow opens a fresh browser session for each query.

Developer Details

Author

sickn33

License

MIT

Skillstore revision

r2

Version notice

The author did not declare a version.

Repository

https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/notebooklm

Ref

81e05e636292629114b76cbb3922fbe57672fc02

Maintenance freshness

8/5/2026

Usage

15 downloads · 228 views

File structure

📄 .gitignore

📄 AUTHENTICATION.md

📄 CHANGELOG.md

📁 images/

📄 example_notebookchat.png

📄 LICENSE

📄 README.md

📁 references/

📄 api_reference.md

📄 troubleshooting.md

📄 usage_patterns.md

📄 requirements.txt

📁 scripts/

📄 __init__.py

📄 ask_question.py

📄 auth_manager.py

📄 browser_session.py

📄 browser_utils.py

📄 cleanup_manager.py

📄 config.py

📄 notebook_manager.py

📄 run.py

📄 setup_environment.py

📄 SKILL.md

More from sickn33

View all

Related Skills

View all