The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill provides instructions to download and execute a shell script from a remote URL (https://astral.sh/uv/install.sh) by piping it directly to the shell (sh). This is a high-privilege execution pattern that avoids script verification before run time.
[EXTERNAL_DOWNLOADS]: The skill requires downloading and installing the notebooklm-mcp-cli package from PyPI. It also utilizes system package managers like Homebrew and winget to fetch external binaries. The notebooklm-mcp-cli tool is a third-party contribution and not an official Google product.
[COMMAND_EXECUTION]: The skill instructs the agent to perform multiple system-level operations, including environment diagnostics, software installation, and persistence configuration. Specifically, it uses the uv tool update-shell command, which modifies shell startup profiles (such as .bashrc or .zshrc) to update the system PATH.
[DATA_EXFILTRATION]: The skill facilitates authentication with external Google services via the nlm login command. This enables the agent to access, read, and write data within the user's Google Notebook account, which is the primary intended function but involves handling sensitive session data.
[PROMPT_INJECTION]: The skill enables the agent to ingest and process data from external Gemini Notebooks, creating a vulnerability surface for indirect prompt injection.
Ingestion points: Data enters the agent's context through the notebooklm-mcp server reading notebook sources and content.
Boundary markers: The instructions lack explicit delimiters or instructions to ignore embedded commands within the processed notebook data.
Capability inventory: The agent possesses the ability to execute the nlm CLI, write files to specific local directories, and communicate with Google's cloud infrastructure.
Sanitization: No content validation or filtering mechanisms are described to mitigate malicious instructions embedded in the external data sources.

opencode-notebooklm