The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to invoke a Python script via the shell using arguments directly derived from user input, specifically --folder, --title, and --tags. This presents a high risk of shell command injection if a user provides a title containing shell metacharacters (e.g., semicolons, backticks, or pipes), as the skill lacks instructions for sanitizing or escaping these inputs.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted conversation data and user-provided metadata to drive file system operations.
Ingestion points: User conversation history and user-supplied strings for note metadata in SKILL.md.
Boundary markers: None identified; the instructions do not require the agent to wrap or delimit user input.
Capability inventory: Execution of a local Python script via shell (python scripts/save_to_obsidian.py) which interacts with the file system.
Sanitization: Absent; there are no instructions to escape shell characters or validate folder paths, increasing the risk of directory traversal or execution of unintended commands.
[DYNAMIC_EXECUTION]: The skill dynamically constructs a shell command at runtime by interpolating user-provided strings into a command template. This pattern is inherently dangerous if the agent does not properly sanitize the resulting command string.
[REMOTE_CODE_EXECUTION]: The core logic file scripts/save_to_obsidian.py is referenced throughout the skill documentation but is missing from the provided bundle. This prevents a security audit of the script's contents to ensure it does not contain malicious code or improper handling of file operations.

obsidian-qa-saver