The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill represents a significant attack surface for indirect prompt injection because its core functionality involves fetching, indexing, and 'chatting' with untrusted external content from URLs, YouTube videos, PDFs, and other documents.
Ingestion points: Untrusted data enters the agent's context through the notebooklm source add command and bulk ingestion scripts like scripts/nlm-bulk-add.sh.
Boundary markers: No explicit boundary markers or 'ignore' instructions are used when presenting content retrieved via notebooklm ask or generated reports to the agent.
Capability inventory: The skill possesses the ability to write to the filesystem via notebooklm download, perform network operations via the API wrapper, and execute complex generation tasks.
Sanitization: No sanitization or filtering of the retrieved content is performed by the wrapper scripts before the data is passed to the agent.
[EXTERNAL_DOWNLOADS]: The skill requires the installation of the notebooklm-py package from PyPI and uses Playwright to install the Chromium browser for authentication purposes. While these are necessary for the tool's functionality, they represent external dependencies.
[COMMAND_EXECUTION]: The skill functions by executing various CLI commands under the notebooklm namespace. This includes potentially long-running operations like audio/video generation and research tasks.
[CREDENTIALS_UNSAFE]: The skill facilitates the storage of Google OAuth session cookies and authentication tokens in ~/.notebooklm/storage_state.json. The documentation correctly advises users to set restrictive permissions (chmod 600) on these files, but they remain sensitive local data.

notebooklm