The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses subprocess.run and asyncio.create_subprocess_exec to interact with its own dependencies (notebooklm-py) and optional tools (trend-pulse). These calls are implemented using list-based arguments and shlex.split, avoiding shell invocation and preventing command injection. The scripts/make_video.sh script also uses quoted variables and provides checks for file existence and symlinks to prevent misuse.
[EXTERNAL_DOWNLOADS]: The skill fetches external content from RSS feeds using httpx and feedparser. These operations are protected by a 5MB size limit and a 30-second timeout to mitigate potential resource exhaustion or denial-of-service attacks. It also interacts with official Google NotebookLM web APIs as part of its core functionality.
[INDIRECT_PROMPT_INJECTION]: The skill has a significant attack surface for indirect prompt injection as it ingests untrusted data from URLs, local files, and RSS feeds for processing by an LLM (NotebookLM).
Ingestion points: scripts/common.py (fetch_rss_entries, ingest_sources) and scripts/pipeline.py (research workflows).
Boundary markers: The skill does not explicitly wrap external content in delimiters or 'ignore' instructions, relying on the underlying notebooklm-py library's interaction with the Google API.
Capability inventory: The skill possesses the ability to execute system commands (ffmpeg, trend-pulse), perform network requests, and write files to the local filesystem.
Sanitization: Implements URL validation via urllib.parse and prevents writing through symlinks.
[DATA_EXFILTRATION]: While the skill reads local files and sends them to Google's servers, this is the documented and intended purpose of the tool. The security policy explicitly warns users about the sensitivity of session cookies stored in the ~/.notebooklm directory and provides clear guidance on protecting this state.

notebooklm-research