Phy Notebooklm

• Risk level: Low
• Analyzed: Mar 22, 2026, 2:03 PM
• Findings: 0
• Version: 1.0.2

Overview

The skill's instructions expect local Python scripts, browser automation, dependency installation, and persistent auth, but the package contains only prose (no code or install spec) and mixes multiple LLM providers — these gaps make the skill internally inconsistent and potentially unsafe to run as-is.

Do not run or trust the instructions as-is. The skill's documentation expects local Python scripts (scripts/run.py and others), dependency installation, and browser-based Google auth, but the published package contains only the SKILL.md text and no code — this is an incomplete or possibly mis-published skill. Before installing or running anything, ask the publisher for the actual source code and a clear install manifest; inspect run.py and all referenced scripts for network calls, dependency installation behavior, and token/file writes; verify the homepage and publisher identity; never paste Google credentials — prefer an OAuth flow you can audit; run any untrusted code in an isolated VM/container and review what persistent files/tokens it creates. If the author cannot provide verifiable source and a trustworthy origin, treat the skill as unsafe.