The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill documentation explicitly states it uses undocumented internal APIs requiring browser cookie extraction for authentication. It provides commands like nlm login --manual --file cookies.txt, which encourage the manual handling of sensitive authentication cookies that grant full access to the user's Google account session.
[INDIRECT_PROMPT_INJECTION]: The skill functions by ingesting external data into NotebookLM, creating a surface for indirect prompt injection attacks.
Ingestion points: The source_add tool and CLI commands ingest content from external URLs, user-provided text, Google Drive IDs, and local files.
Boundary markers: There are no documented delimiters or instructions for the agent to distinguish between its own tasks and instructions potentially embedded in the ingested sources.
Capability inventory: The skill has powerful capabilities, including querying ingested data (notebook_query), generating studio artifacts (studio_create), and sharing notebooks publicly (notebook_share_public).
Sanitization: The documentation does not specify any sanitization, filtering, or validation of the content fetched from external URLs or files before it is processed by the AI.
[DYNAMIC_EXECUTION]: The skill supports a pipeline feature (nlm pipeline run) that executes workflows defined in custom YAML files. This involves dynamic interpretation and execution of multi-step processes defined in external configuration data.
[COMMAND_EXECUTION]: The documentation provides examples of shell command execution and Python subprocess.run calls to interact with the NotebookLM service. Improperly sanitized user input passed to these commands could lead to command injection.
[DATA_EXFILTRATION]: The skill provides tools for sharing notebooks publicly and inviting specific email addresses, as well as downloading generated research artifacts (audio, video, slides). These features could be leveraged to exfiltrate processed data from the agent's environment.

notebooklm-mcp-cli