The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from local files, directories, and external URLs when adding sources to NotebookLM (e.g., scripts/remote_manager.py). It also retrieves and returns answer text from the NotebookLM web interface to the agent. This creates a surface for indirect prompt injection where malicious instructions embedded in documents or web pages could influence the agent's behavior during answer processing.
Ingestion points: Local file uploads through --file and --dir flags; external URL ingestion via the --url flag in remote_manager.py; and automated text extraction from NotebookLM chat containers in ask_question.py.
Boundary markers: None identified; retrieved content is returned as part of the JSON response without explicit delimiters or warnings to the agent.
Capability inventory: The skill has capabilities for network access (Playwright), file reading, and file writing (for exports).
Sanitization: Output is serialized as JSON, but the natural language content retrieved from sources or the browser interface is not sanitized for embedded instructions.
[PROMPT_INJECTION]: In scripts/ask_question.py, the variable FOLLOW_UP_REMINDER contains emphatic instructions ("EXTREMELY IMPORTANT") appended to every answer returned to the agent. This steers the agent to evaluate its own clarity and ask follow-up questions before responding to the user. While this is a functional part of the skill's design to ensure comprehensive answers, it utilizes behavior-steering patterns commonly found in prompt injections.
[COMMAND_EXECUTION]: The skill's test suite in tests/test_smoke_playwright.py utilizes subprocess.run() to execute the skill's own Python scripts (e.g., auth_manager.py, remote_manager.py) during end-to-end smoke testing. These calls are limited to the skill's internal scripts and are standard for integration testing.

notebooklm