NotebookLM Audio Generator

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI03: Identity and Privilege Abuse

What this means

The agent may use the user's authenticated NotebookLM/Google session to create notebooks, add sources, and download generated audio.

Why it was flagged

The skill requires the user to authenticate a NotebookLM CLI session even though registry metadata lists no primary credential. This is expected for NotebookLM automation, but it is account access the user should notice.

Skill content

Authenticate:\n```bash\nnlm login\n```

Recommendation

Authenticate only with the intended Google/NotebookLM account and review the notebook contents after generation if you want to remove uploaded sources.

Note

ASI07: Insecure Inter-Agent Communication

What this means

Private documents or Drive content selected by the user may be uploaded to and processed by Google's NotebookLM service.

Why it was flagged

The workflow sends user-selected local files, web URLs, YouTube URLs, and Drive document IDs to NotebookLM through the CLI/tool integration. This is the core purpose, but it is a sensitive external data flow.

Skill content

Other Files: Use `source_add(source_type="file", file_path="...")`.\n- **URLs/YouTube:** Use `source_add(source_type="url", url="...")`.\n- **Drive:** Use `source_add(source_type="drive", document_id="...")`.

Recommendation

Only select sources you are comfortable sending to NotebookLM, and avoid confidential files unless your account and organization policies allow that use.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing or running these tools gives third-party code access to the local environment used for the workflow.

Why it was flagged

The setup uses unpinned external packages and clones/runs a GitHub helper script for EPUB support. The instructions are visible and user-directed, but provenance and version pinning are not provided.

Skill content

uv tool install notebooklm-mcp-cli\n# OR\npip install notebooklm-mcp-cli\n...\ngit clone https://github.com/SPACESODA/epub2txt.git\n...\n./run.sh

Recommendation

Review the package/repository, pin trusted versions if possible, and install them in an isolated environment if handling sensitive documents.