The Agent Skills Directory

[COMMAND_EXECUTION]: Several Python scripts (notebooklm_health.py, notebooklm_artifact_matrix.py, local_artifact_smoke.py) use the subprocess module to execute system commands. These calls are used for legitimate operational tasks, such as checking the status of the NotebookLM CLI, detecting running browser processes, and executing rendering tasks via Node.js.
[EXTERNAL_DOWNLOADS]: The skill provides instructions and scripts for installing external dependencies, such as the notebooklm-py Python package and the open-design repository. These are essential for the skill's primary function of media transformation and are documented as manual installation steps for the user.
[REMOTE_CODE_EXECUTION]: The script scripts/local_artifact_smoke.py dynamically generates a Node.js script string to perform visual rendering via Playwright. The generated script is executed using node -e. Analysis shows that user-provided paths are JSON-encoded before being injected into the template, effectively mitigating script injection risks.
[DATA_EXFILTRATION]: While the skill ingests untrusted data (articles from URLs or local files), it implements security boundaries by instructing the agent to keep private credentials (API keys, session tokens) in isolated configuration files (config.yml) outside the primary codebase or document vaults. It also implements restrictive file permissions (chmod 700) for local home directories used by providers.

soia-pkm-transform