The Agent Skills Directory

[PROMPT_INJECTION]: The skill provides explicit instructions in SKILL.md to override the agent's standard interaction model. The "Follow-Up Mechanism" section commands the agent to "STOP", "do not immediately respond to user", and "REPEAT" queries until its research is complete, overriding default response patterns.\n- [COMMAND_EXECUTION]: Scripts such as ask_api.py and auto_add.py utilize subprocess.run with the shell=True argument to execute system commands. This is a security anti-pattern that presents an injection risk if the command strings were to include untrusted input.\n- [EXTERNAL_DOWNLOADS]: The setup_environment.py script automatically downloads and installs the Google Chrome binary from external sources via the patchright install chrome command during the skill's environment preparation.\n- [DATA_EXFILTRATION]: To maintain persistent authentication, the skill captures and stores sensitive Google session cookies in data/browser_state/state.json. While this data remains local, the storage of decrypted session tokens creates a high-value target for credential exposure.\n- [PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection from processed documents.\n
Ingestion points: Content is retrieved from the NotebookLM web interface in scripts/ask_question.py using DOM selectors.\n
Boundary markers: The skill does not use delimiters or specific safety instructions to isolate the retrieved content from the agent's reasoning process.\n
Capability inventory: The skill allows the agent to execute arbitrary local Python scripts through the run.py wrapper and perform filesystem operations via upload_source.py.\n
Sanitization: There is no evidence of sanitization or filtering of the response text retrieved from the browser before it is returned to the agent.

notebooklm