The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill executes npm install, which retrieves packages from the public npm registry. These include standard development tools (TypeScript, ESLint, esbuild) and ecosystem-specific packages such as obsidian and eslint-plugin-obsidianmd.
[COMMAND_EXECUTION]: The setup process involves running shell commands in the project directory, specifically npm install for dependency resolution and npx tsc --noEmit to verify code correctness against the generated configuration.
[INDIRECT_PROMPT_INJECTION]: The skill takes user-provided metadata (ID, Name, Author, Description) and interpolates it into file templates, creating a potential surface for injection.
Ingestion points: User input collected during the plugin initialization prompts (SKILL.md, Step 1).
Boundary markers: The templates do not use explicit delimiters or instructions to ignore embedded commands in the user input.
Capability inventory: The skill can perform file system writes and execute shell commands (npm, npx).
Sanitization: The skill mitigates this risk by requiring the agent to validate all inputs against specific rules in Step 2, including regex enforcement for the plugin ID and content restrictions for the name and description fields.

obsidian-scaffold