The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses subprocess.run to manage its internal virtual environment and execute its various Python modules (e.g., ask_question.py, auth_manager.py). This behavior is well-contained within the skill's directory and is standard for isolated environment management.
[EXTERNAL_DOWNLOADS]: During setup, the skill downloads required Python dependencies from PyPI and the Google Chrome browser for use with the Patchright automation framework. The skill implements integrity verification by using a lock file (requirements.lock) with SHA-256 hashes.
[CREDENTIALS_UNSAFE]: Authentication state, including session cookies for Google accounts, is stored locally in the scripts/data/browser_state/ directory. The skill proactively mitigates data exposure risks by implementing a _harden_perms function that sets restrictive filesystem permissions (0o600/0o700) on these sensitive files and directories.
[PROMPT_INJECTION]: The skill processes answer data retrieved from Google NotebookLM. As it ingests content from a remote third-party source, it possesses a surface for indirect prompt injection, where an attacker could place malicious instructions inside a source document to influence the agent's subsequent actions.

blog-notebooklm