The Agent Skills Directory

Indirect Prompt Injection (HIGH): The skill extracts text from external URLs (Twitter/X) and provides it as a source for LLM reasoning via NotebookLM. An attacker could craft a tweet containing instructions to override the agent's behavior.
Ingestion points: The skill_mcp playwright browser_run_code function in TWITTER_EXTRACTION_EXAMPLE.md extracts innerText from the web page.
Boundary markers: Absent. The extracted $EXTRACTED content is placed directly into a markdown file without delimiters or 'ignore' instructions.
Capability inventory: notebooklm source add (file ingestion) and notebooklm ask (LLM reasoning/decision making based on source).
Sanitization: Absent. The skill does not filter or sanitize the extracted text for malicious instructions.
Dynamic Execution (MEDIUM): The skill relies on executing arbitrary JavaScript code at runtime within a browser context.
Evidence: Multiple blocks in TWITTER_EXTRACTION_EXAMPLE.md use skill_mcp playwright browser_run_code with complex JS functions to handle selectors and content extraction.
Command Execution (LOW): The provided automation script uses shell commands to handle data flow and external tool calls.
Evidence: Uses cat > "$OUTPUT_FILE" << EOF to create local files and jq to parse tool outputs. While standard, this represents a local command execution surface.

notebooklm