The Agent Skills Directory

[COMMAND_EXECUTION]: The skill directs the agent to execute shell commands using python3 to run a script named claude-obsidian.py. These commands interpolate multiple shell variables ($CORE, $BUNDLE, $VAULT, $APPROVAL_SHA256), creating a risk of command injection if the underlying tool does not adequately escape input derived from the user's environment or vault structure.
[DYNAMIC_EXECUTION]: The skill depends on a script (claude-obsidian.py) located outside of the skill's own package within a specified PRODUCT_ROOT. The contents and security properties of this script cannot be verified through static analysis of the skill itself.
[INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted data from note properties and .base files in an Obsidian vault to construct transactions. * Ingestion points: The agent is instructed to inspect representative note properties and existing .base files. * Boundary markers: There are no explicit delimiters or instructions to treat data as untrusted or to ignore embedded instructions. * Capability inventory: The skill possesses file read capabilities and the ability to execute shell commands. * Sanitization: While basic YAML and expression validation are mentioned, there are no specific defenses against malicious instructions embedded in note data.

obsidian-bases