notebooklm-lore

PassAudited by ClawScan on May 10, 2026.

Overview

The skill is a coherent instruction-only wrapper for installing Lore, but it relies on external code, NotebookLM login/session state, and MCP tooling that users should review before enabling.

This skill does not include executable code itself, but it tells your agent how to install and configure external Lore/NotebookLM tooling. Review the external repository and MCP package, use a virtual environment, complete login yourself, and protect ~/.notebooklm session files.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The code that actually runs may change outside this skill and was not available for review in this artifact set.

Why it was flagged

The skill delegates installation and runtime behavior to external GitHub/Python package sources that are not bundled or pinned in the reviewed artifacts.

Skill content
Repo: https://github.com/prantikmedhi/lore ... Clone or update the repo. ... pip install -e . ... uvx ... --from notebooklm-skill
Recommendation

Inspect the Lore repository and MCP package before use, prefer pinned versions or commits, and install in a virtual environment.

What this means

After login, the local tool and MCP server may be able to access or act within the user's NotebookLM account.

Why it was flagged

The integration depends on a user-authenticated NotebookLM session, which grants account-level access to the installed tooling, although the instructions keep login user-directed and warn against exposing session data.

Skill content
NotebookLM auth is interactive. The agent must ask the user to run: python3 -m notebooklm login ... Do not print, copy, or commit any auth/session state.
Recommendation

Only authenticate accounts you intend the tool to use, avoid sharing session files, and revoke or clear the session if you no longer trust the installation.

What this means

Once configured, the agent may send requests through the MCP server that interact with NotebookLM and related data.

Why it was flagged

The skill instructs enabling an MCP server, which can expose NotebookLM-related operations to the agent through an additional tool boundary.

Skill content
Use the repo’s `.mcp.json` (preferred) or add an equivalent MCP server entry ... "command": "uvx", "args": ["--from", "notebooklm-skill", "notebooklm-mcp"]
Recommendation

Enable the MCP server only when needed, review the MCP server package, and understand which NotebookLM operations it exposes.