The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes untrusted external content (URLs, documents, and pasted text) to build its knowledge base, which creates a surface for indirect prompt injection attacks.
Ingestion points: SKILL.md (Phase 1.1, 1.2) instructions define how the agent should ingest local files, URLs, and search results.
Boundary markers: The skill lacks explicit instructions or delimiters to treat ingested content as untrusted data or to ignore embedded commands.
Capability inventory: Across SKILL.md, the agent is granted capabilities to execute shell commands (python3, nlm), write progress files to the local system, and utilize network-enabled search tools.
Sanitization: No sanitization, escaping, or validation of external content is performed before the agent processes and summarizes it.
[COMMAND_EXECUTION]: The skill invokes local Python scripts and third-party command-line tools to provide its core functionality.
Specifically, it executes python3 <omni-search-dir>/scripts/omni_search.py for search and fetching operations.
It also integrates with the nlm (NotebookLM) CLI tool, executing commands like nlm status, nlm query, and nlm studio to manage the knowledge base and generate audio.
[EXTERNAL_DOWNLOADS]: The skill instructs the user to install external dependencies and recommends specific third-party tools.
Recommends installing the notebooklm-mcp-cli Python package via pip.
Recommends the installation of the omni-search-skill from the author's public GitHub repository.
[DATA_EXFILTRATION]: The skill is designed to read file content from local paths specified by the user or potentially provided via an external source.
Instructions in SKILL.md (Phase 1.1) allow reading files from absolute and relative paths (/, ~, ./). This could be exploited by an indirect prompt injection to access sensitive system files or credentials if the agent's environment is not restricted.

learn