The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions in SKILL.md direct the AI agent to execute a local Python script (scripts/canvas_lib.py) using a shell command pipeline (e.g., cat <<EOF | python3 ...).
[PERSISTENCE]: The script scripts/canvas_lib.py contains an arbitrary file write vulnerability in its save method. It accepts a filename directly from the output field of the input JSON and opens it for writing (open(filepath, "w")) without any path validation, sanitization, or extension checks. This allows for the overwriting of critical files such as ~/.bashrc, ~/.zshrc, or ~/.ssh/authorized_keys to establish persistent access or execute malicious code upon the next shell login.
[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests untrusted user content for node text and file paths without adequate safeguards.
Ingestion points: User-provided strings used to populate the nodes (text field) and the output filename in the JSON payload.
Boundary markers: None. There are no instructions or delimiters to prevent the agent from following instructions embedded within the data it is processing.
Capability inventory: File system write capability via the save method in scripts/canvas_lib.py.
Sanitization: None. The script does not validate the target path or sanitize the markdown content within the nodes.

obsidian-canvas