The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The install.sh script downloads and installs software from third-party GitHub repositories (teng-lin/notebooklm-py and Bwkyd/wexin-read-mcp) that are not associated with trusted organizations or vendors.
[REMOTE_CODE_EXECUTION]: The scripts/fetch_url.sh script uses npx --yes agent-fetch to dynamically download and execute a package from the NPM registry at runtime.
[COMMAND_EXECUTION]: Multiple scripts (main.py, check_env.py, get_podcast_transcript.py) utilize subprocess.run to execute external commands such as curl, notebooklm, and playwright. User-provided inputs, including URLs and file paths, are passed as arguments to these commands, increasing the attack surface for command injection if the underlying tools are compromised.
[DATA_EXFILTRATION]: The skill transmits user-supplied URLs and metadata to external processing services and APIs, including r.jina.ai, defuddle.md, and openapi.biji.com. While these are part of the stated functionality (paywall bypass and transcription), they involve sending data to third-party infrastructure.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection due to its core function of fetching and processing untrusted content from arbitrary web sources.
Ingestion points: Data enters the agent's context through scripts/fetch_url.sh, scripts/get_podcast_transcript.py, and the Feishu scraper (feishu-read-mcp/src/scraper.py).
Boundary markers: No boundary markers (e.g., delimiters) or "ignore embedded instructions" warnings are used when processing the retrieved external content.
Capability inventory: The skill possesses significant capabilities, including network access, file system writes to /tmp, and the execution of external CLI tools.
Sanitization: No sanitization or validation of the fetched text is performed before it is uploaded to NotebookLM or processed by the agent.

qiaomu-anything-to-notebooklm