The Agent Skills Directory

[PERSISTENCE_MECHANISMS]: Documentation in README.md and QUICKSTART_CN.md explicitly instructs users to modify shell configuration files such as ~/.bashrc and ~/.zshrc to permanently change the system PATH environment variable.
[PRIVILEGE_ESCALATION]: The installation guide recommends using sudo for system dependencies and the --break-system-packages flag for pip, which bypasses operating system protections designed to maintain environment stability.
[DATA_EXPOSURE_AND_EXFILTRATION]: The skill manages authentication via storage_state.json, which contains sensitive session cookies. The documentation encourages manual copying and movement of this file between machines, increasing the risk of credential exposure.
[COMMAND_EXECUTION]: The core script scripts/notebooklm.py uses subprocess.run to execute commands, forwarding arguments directly from the agent's input to the shell.
[INDIRECT_PROMPT_INJECTION]: The sub-agent delegation strategy defined in SKILL.md facilitates an attack surface where user-controlled strings, such as notebook IDs or task descriptions, are interpolated into shell scripts.
Ingestion points: User-provided notebook IDs and task parameters in SKILL.md.
Boundary markers: No delimiters or protective escape sequences are used in the provided command templates.
Capability inventory: Arbitrary shell command execution via subprocess.run in scripts/notebooklm.py across all tool functionalities.
Sanitization: No evidence of input validation or sanitization is present in the wrapper script.
[DYNAMIC_EXECUTION]: The Python wrapper dynamically determines the binary to execute using the NOTEBOOKLM_BIN environment variable, which could allow for the execution of unauthorized binaries if the environment is compromised.

notebooklm