The Agent Skills Directory

[PROMPT_INJECTION]: The skill employs highly directive instructions to control agent logic. In SKILL.md, the 'Follow-Up Mechanism' uses 'EXTREMELY IMPORTANT' markers and directives like 'STOP
Do not immediately respond to user' and 'REPEAT' to enforce an iterative processing loop, which overrides standard agent response patterns.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from Google NotebookLM and uses it to influence subsequent shell command arguments.\n
Ingestion points: Data enters the context through ask_question.py, which parses text from the NotebookLM web interface.\n
Boundary markers: No explicit delimiters or instructions are provided to the agent to sanitize or ignore embedded instructions when extracting metadata from notebook answers.\n
Capability inventory: The skill uses a run.py wrapper to execute shell commands across multiple utility scripts.\n
Sanitization: There is no logic for escaping or validating external content before it is interpolated into shell command arguments by the agent.\n- [COMMAND_EXECUTION]: The skill utilizes a scripts/run.py wrapper that executes Python scripts via subprocess.run(). While it avoids direct shell interpolation by using list-based arguments, the arguments (names, descriptions, tags) are derived by the AI from external, potentially malicious document content.\n- [CREDENTIALS_UNSAFE]: The skill manages sensitive Google session cookies, storing them in ~/.claude/skills/notebooklm/data/browser_state/state.json. The auth_manager.py script handles manual injection and persistent storage of these credentials to bypass authentication limits, representing a sensitive data management surface.\n- [DYNAMIC_EXECUTION]: The setup_environment.py script automatically configures the runtime environment, installing Python packages and downloading browser binaries via patchright during the initial setup phase.

notebooklm