The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The documentation for setting up 'Obsidian Headless' instructs users to execute a command containing plain-text credentials (ob login --email <email> --password '<password>'). This practice exposes sensitive information to shell history files and system process listings, which is a major security risk.
[COMMAND_EXECUTION]: The skill utilizes the execute_code tool to perform 'Lint' operations. It generates and runs Python scripts at runtime to programmatically scan the local wiki directory, analyze file structures, and detect inconsistencies. This dynamic code generation increases the attack surface if the agent is manipulated.
[EXTERNAL_DOWNLOADS]: Through the 'Ingest' operation, the skill uses web_extract to fetch content from arbitrary user-provided URLs and save them to the local filesystem. This process downloads untrusted external data into the agent's working environment.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests, parses, and summarizes external web articles and papers. Maliciously crafted content within these sources could potentially contain hidden instructions designed to manipulate the agent during the summarization or cross-referencing phases.
Ingestion points: Web content fetched via web_extract (saved to raw/articles/) and user-provided text.
Boundary markers: None specified for the parsing of ingested markdown or web content.
Capability inventory: Access to execute_code, read_file, search_files, and web_extract across the local filesystem and network.
Sanitization: No explicit sanitization or filtering of the fetched content is described before it is processed by the LLM.

llm-wiki