The Agent Skills Directory

[COMMAND_EXECUTION]: Local shell command execution via subprocess.run() is utilized in scripts/__init__.py, scripts/run.py, and scripts/setup_environment.py exclusively for managing the local virtual environment, installing dependencies via pip, and installing the required browser binaries via patchright. These calls are restricted to static arguments and internal operational scripts.
[INDIRECT_PROMPT_INJECTION]: The skill ingests raw textual data returned from Google NotebookLM notebooks, which may incorporate content from external documents.
Ingestion points: Data enters the context via webpage container queries in scripts/ask_question.py and scripts/browser_session.py when pulling response elements.
Boundary markers: Missing formal prompt boundary enclosures around the external answer content before returning it to the user.
Capability inventory: Subprocess execution is present across the skill files but limited strictly to environment setup and wrapper orchestration.
Sanitization: Input length bounds are strictly enforced on CLI parameters via a _bounded string type check to avoid resource exhaustion attacks.
[SAFE]: Stored authentication files and browser profiles are held strictly locally inside the data/ directory, excluded via .gitignore, and secured using strict file permission flags (0o600 and 0o700). Outgoing navigation is tightly locked to the official notebooklm.google.com domain via explicit validation checks.

blog-notebooklm