The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses unvalidated user-provided input ({topic}) directly within shell commands, such as yt-dlp --flat-playlist "ytsearch20:{topic}" and notebooklm create "{topic}". This creates a vulnerability where a malicious user or indirect prompt could inject arbitrary shell commands.
[EXTERNAL_DOWNLOADS]: The instructions require the installation of notebooklm-py[browser]. This is an unofficial, third-party community wrapper for Google's NotebookLM service, rather than an official tool from a trusted vendor. Relying on unofficial wrappers for sensitive research data introduces a supply chain risk.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection (Category 8).
Ingestion points: Untrusted data enters the agent context through YouTube video titles, channel names, and external responses from the NotebookLM CLI.
Boundary markers: Absent. External data from YouTube search results and NotebookLM queries are interpolated directly into shell commands and file-writing operations without delimiters.
Capability inventory: The skill possesses significant capabilities, including arbitrary shell execution via yt-dlp and notebooklm, and the ability to write files to the local filesystem (Obsidian vault).
Sanitization: There is no evidence of sanitization or escaping of the {topic} variable or data returned from external sources before it is used in CLI commands or written to markdown files.

youtube-research