The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted metadata and snippets from external search results (YouTube, Brave, and Reddit) which are then processed by Google NotebookLM using the skill's brand prompts. This creates a surface for indirect prompt injection where an attacker could influence the generated research outputs by placing malicious instructions in indexed web content.
Ingestion points: Untrusted data enters via scripts/web_research.py (which fetches search results from Brave and Reddit) and scripts/youtube_research.py (which fetches video metadata via yt-dlp).
Boundary markers: There are no specific delimiters or "ignore previous instructions" warnings applied to the external content before it is pushed to the NotebookLM service.
Capability inventory: The skill executes several internal scripts using subprocess and transmits data to the Google NotebookLM cloud service.
Sanitization: No sanitization or filtering of the fetched text is performed before interpolation into the analysis workflow.
[EXTERNAL_DOWNLOADS]: The scripts/install.sh script downloads and installs multiple Python packages from official registries and triggers the automatic installation of browser binaries via the scrapling library. These are required for the skill's functionality but involve downloading executable components from remote sources.
[COMMAND_EXECUTION]: The orchestrator scripts (scripts/pipeline.py and scripts/research_pipeline.py) use the subprocess module to run other Python scripts within the skill folder. While the implementation uses argument lists to avoid shell injection, it constitutes an automated command execution pipeline.

phoenix-research-pipeline