The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from research PDFs, creating a surface for indirect prompt injection attacks.
Ingestion points: The script scripts/extract_pdfs.py extracts text from user-provided PDFs and saves it to a local cache (~/.local/cache/paper-vault-texts/). This text is subsequently ingested by LLM subagents through the Read tool as specified in references/subagent-prompt.md.
Boundary markers: While the subagent prompt in references/subagent-prompt.md defines clear output structures, it lacks explicit boundary markers or instructions to treat the input text as data rather than instructions, making it vulnerable to embedded commands.
Capability inventory: The subagents have the capability to write files to the user's local filesystem (Obsidian vault) using the Write tool and read existing files using the Read tool.
Sanitization: There is no evidence of sanitization or filtering of the extracted text before it is passed to the subagents.
[COMMAND_EXECUTION]: The skill relies on local command execution to perform text extraction and vault analysis.
Evidence: The skill utilizes Bash and python3 to execute a local script (scripts/extract_pdfs.py) for PDF processing. It also suggests the use of grep and sort pipelines in references/concept-extraction.md to identify recurring terms within the vault. These commands are consistent with the skill's stated utility.

obsidian-paper-vault