The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from Google NotebookLM documents which could contain malicious instructions designed to influence the agent's behavior during synthesis.
Ingestion points: External text is extracted from the NotebookLM UI using Playwright selectors in scripts/ask_question.py and scripts/browser_session.py.
Boundary markers: Absent. The skill instructions in SKILL.md encourage the agent to synthesize and act on retrieved information without explicit delimiters for the external content.
Capability inventory: Includes subprocess execution via scripts/run.py, local file system writes in scripts/notebook_manager.py, and authenticated network operations via scripts/ask_question.py.
Sanitization: None detected. The retrieved text is returned to the agent context as a raw string.
[EXTERNAL_DOWNLOADS]: The skill performs automated setup tasks that download external resources.
Evidence: scripts/setup_environment.py and scripts/__init__.py execute pip install to fetch dependencies and patchright install chrome to download the browser binary from official repositories.
[COMMAND_EXECUTION]: The skill relies on a wrapper script to execute its functionality through shell commands.
Evidence: scripts/run.py and scripts/setup_environment.py use subprocess.run() to manage the virtual environment, install packages, and launch automation scripts. This is the intended execution model described in SKILL.md.
[CREDENTIALS_UNSAFE]: The skill implements a persistent authentication mechanism that stores sensitive session data locally.
Evidence: scripts/auth_manager.py saves browser cookies and session state to data/browser_state/state.json following a manual Google login. While this is documented as the intended purpose for cross-session reliability, it creates a local sensitive data footprint.

notebooklm