Is cm-notebooklm-25b3ac safe to install?

SaferSkills independently audited cm-notebooklm-25b3ac (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

.codex/skills/cm-notebooklm/SKILL.md · 1 file

.codex/skills/cm-notebooklm/SKILL.md5.0 KB · Markdown

name: cm-notebooklm

description: "Sync high-value dev knowledge (skills, decisions, lessons) into Google NotebookLM for cloud recall, podcasts, and flashcards. Pairs with Dockit/deep-search. Use for NotebookLM, nlm, knowledge base, skill sync, or cross-machine AI memory."

Goal

Cloud brain / soul cho AI — lưu trữ kiến thức giá trị nhất, đồng bộ qua nhiều máy tính. brain.md = compiled source of truth, upload 1 lần thay vì 50.

How It Works

Skills + Lessons + Experiences
        ↓ compile
  ~/.codymaster/brain.md  (local file = backup)
        ↓ upload (1 API call)
  NotebookLM (cloud = cross-machine sync)

All automation via scripts/brain-sync.sh — AI chỉ cần gọi script.

Instructions

The Dual-Brain Architecture

CodyMaster uses a Dual-Brain approach to scale memory across multiple projects without context collapse:

Master Brain (`codymaster`): Global brain storing Meta-Learnings, proven Architecture Decisions, and universal patterns. Evolved via the "Rule of 3" (knowledge graduation).
Project Brain (Isolated): Optional local brain created per project to hold internal PRDs, APIs, and local code context from ./docs.

Level	Goal	Query Command
Master	Tìm pattern chung	`nlm notebook query codymaster "..."`
Project	Tìm context domain	`nlm notebook query $(cat .cm/notebook_id) "..."`

🤖 AI Rule: Tự đưa quyết định khi hỏi: Hỏi codymaster cho các giải pháp mang tính hệ thống chung. Hỏi qua .cm/notebook_id cho các business logic đặc thù dự án đang làm.

Master Brain Setup (Global)

# 1. Install CLI
uv tool install notebooklm-mcp-cli

# 2. Setup Master Brain
bash ~/.gemini/antigravity/skills/cm-notebooklm/scripts/brain-sync.sh init

Project Brain Setup (Local - Optional)

Nếu dự án đủ lớn và nhiều doc:

# Tạo Project Brain riêng cho thư mục hiện tại
bash ~/.gemini/antigravity/skills/cm-notebooklm/scripts/brain-sync.sh init-project

Daily Usage

SCRIPT=~/.gemini/antigravity/skills/cm-notebooklm/scripts/brain-sync.sh

# Add a lesson learned
bash $SCRIPT lesson "Tên bài học"
# → Edit ~/.codymaster/lessons.md → fill in details

# Add coding experience
bash $SCRIPT experience "Tên pattern"
# → Edit ~/.codymaster/experiences.md → fill in details

# Sync to Master Brain (Thêm rule of 3)
bash $SCRIPT sync

# Sync to Project Brain (Up tài liệu local docs/)
bash $SCRIPT sync-project

# Check status
bash $SCRIPT status

# Query
nlm notebook query codymaster "your question"

Auto-Sync Triggers

AI detect và hỏi user (không tự động):

Trigger	Prompt
Skill mới tạo	"Sync skill mới vào brain?" → `bash $SCRIPT sync`
Bug fixed / post-mortem	"Lưu bài học?" → `bash $SCRIPT lesson "..."`
Architecture changed	"Update brain?" → `bash $SCRIPT sync`
User nói "sync/update"	→ `bash $SCRIPT sync`

Cross-Machine (Máy Mới)

uv tool install notebooklm-mcp-cli
nlm login
nlm notebook list          # CodyMaster Brain already there
nlm alias set codymaster <id>
# Done! Query ngay: nlm notebook query codymaster "..."

Content Generation

nlm audio create codymaster --format deep_dive --confirm   # Podcast
nlm report create codymaster --format "Study Guide" --confirm
nlm flashcards create codymaster --difficulty medium --confirm
nlm studio status codymaster

What Gets Indexed

✅ HIGH-VALUE (auto-compiled into brain.md):
├── Skill Index (names + descriptions — NOT full SKILL.md)
├── Lessons Learned (~/.codymaster/lessons.md)
├── Coding Experiences (~/.codymaster/experiences.md)
└── AGENTS.md (project identity)

❌ NOT INDEXED (use qmd/cm-deep-search instead):
├── Full SKILL.md files (too many, hard to maintain)
├── Source code, tests, configs
└── Duplicated content

Memory Architecture

Session  → variables        → temporary
Working  → CONTINUITY.md    → ~500 words/turn
Local    → qmd              → BM25+vector, offline, stable
Cloud    → NotebookLM       → AI brain, cross-machine, podcast

Integration

Skill	Role
`cm-deep-search`	Local search complement (code)
`cm-dockit`	Generate docs → select high-value → feed to brain
`cm-continuity`	Session memory, brain = long-term
`skill-creator-ultra`	TRIGGER: new skill → prompt sync
`cm-debugging`	TRIGGER: bug fixed → prompt lesson

Constraints

🔌 nlm CLI = third-party (jacob-bd). May break. Fallback: cm-deep-search.
🧠 Selective only — quality > quantity. Don't dump everything.
🔐 NO secrets in NotebookLM — cloud service.
❌ NO delete without user confirmation.
🤖 NO nlm chat start — use nlm notebook query only.
🔄 Auto-sync = ask first, never silent upload.

cm-notebooklm-25b3ac— agent skill

Is cm-notebooklm-25b3ac safe to install?

Goal

How It Works

Instructions

The Dual-Brain Architecture

Master Brain Setup (Global)

Project Brain Setup (Local - Optional)

Daily Usage

Auto-Sync Triggers

Cross-Machine (Máy Mới)

Content Generation

What Gets Indexed

Memory Architecture

Integration

Constraints

Audit the pieces. Scan the whole. Decide.