The Agent Skills Directory

[COMMAND_EXECUTION]: The skill interacts with a 'notebooklm' CLI tool using subprocess.run in scripts/notebooklm_gate.py and scripts/notebooklm_slide_deck.py. These calls use list-based arguments instead of shell strings, effectively preventing command injection vulnerabilities. The use of the CLI is an intended part of the skill's automation workflow.
[EXTERNAL_DOWNLOADS]: The scripts/extract.py script fetches news article content from arbitrary URLs using the trafilatura library and the Playwright headless browser. This functionality is essential to the skill's purpose as a news scraper and is performed using standard web automation tools.
[DATA_INGESTION_SURFACE]: The skill processes untrusted data extracted from external websites (news articles). To mitigate risks such as Cross-Site Scripting (XSS) in the generated dashboard, scripts/render_dashboard.py consistently applies html.escape to all content derived from external sources or AI summaries before rendering the final HTML.
[PATH_TRAVERSAL_PREVENTION]: File operations in scripts/notebooklm_slide_deck.py utilize a safe_slug function that restricts filenames to alphanumeric and Korean characters, preventing path traversal attacks when generating artifacts.

news-scrap-codex