The Agent Skills Directory

[COMMAND_EXECUTION]: The helper script scripts/make_video.sh uses the eval command to execute an ffmpeg command line constructed from shell variables. Specifically, the variable $AUDIO (which corresponds to the second command-line argument) is interpolated directly into the eval string. This allows for arbitrary command execution if a user provides a filename containing shell metacharacters.
[DATA_EXFILTRATION]: The skill manages and accesses sensitive Google session data (cookies and tokens) stored at ~/.notebooklm/storage_state.json. Multiple scripts, including scripts/auth_helper.py and mcp_server/tools.py, read and write this file. While necessary for the skill's functionality, these credentials represent high-value targets for theft if the local environment is compromised.
[PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection by processing untrusted data from external sources.
Ingestion points: Untrusted content enters the agent's context through URL sources, YouTube transcripts, and RSS feed entries in mcp_server/server.py (nlm_create_notebook) and scripts/pipeline.py (workflow_batch_digest).
Boundary markers: Absent; the skill does not use delimiters or instructions to ignore embedded commands when passing source content to the LLM.
Capability inventory: The agent has access to subprocess.run calls (to the trend-pulse tool) and the ability to write files to the system via artifact downloads.
Sanitization: Absent; external data is retrieved and passed to the NotebookLM API without filtering, validation, or escaping.
[EXTERNAL_DOWNLOADS]: The scripts/pipeline.py script attempts to execute npx trend-pulse if the local command is not found. This involves downloading and executing a package from a remote registry. As trend-pulse is a known resource from the same author, this is documented as a vendor-specific dependency.

notebooklm-research