The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill possesses a significant attack surface for indirect prompt injection as it is designed to ingest and process data from uncontrolled external sources.\n
Ingestion points: The skill reads data from arbitrary URLs, YouTube transcripts, Google Drive files, and local documents (PDF, MD, DOCX) via the notebooklm source add command.\n
Capability inventory: The agent can execute shell commands to generate content (audio, video, reports) and perform chat-based Q&A based on the ingested data.\n
Boundary markers: The instructions do not define clear delimiters or use 'ignore instructions' markers for external content.\n
Sanitization: There is no evidence of sanitization or filtering of external content before it is processed by the AI models.\n- [CREDENTIALS_UNSAFE]: The skill facilitates the creation and storage of highly sensitive authentication data. The notebooklm login command saves Google session cookies and tokens to ~/.notebooklm/storage_state.json. Compromise of this file would lead to full unauthorized access to the user's Google account.\n- [EXTERNAL_DOWNLOADS]: The skill requires installing notebooklm-py, which is an unofficial third-party package. It also triggers the download of browser binaries (Chromium) via Playwright, which is a common but external dependency.\n- [PRIVILEGE_ESCALATION]: The setup instructions include playwright install-deps chromium, a command that typically requires administrative privileges on Linux systems to install system-level library dependencies.\n- [COMMAND_EXECUTION]: The core functionality of the skill is built upon executing a wide range of CLI commands, including file system access for uploads and downloads of research materials and generated artifacts.

notebooklm