The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes the entire content of every markdown file in the Obsidian vault (Step 2 and Step 3). Since this content is untrusted (can be sourced from external imports or shared wikis), any malicious instructions hidden within the text, comments, or metadata could influence the agent's behavior at runtime.
Ingestion points: Full content of all .md files in the vault (excluding _archives/, _readouts/, .obsidian/).
Boundary markers: No explicit delimiters or instructions are used to distinguish user data from agent instructions during content processing.
Capability inventory: File system writing/modification, Git operations (git add, git commit), and specialized CLI utility execution (obsidian-wiki, qmd).
Sanitization: No sanitization or safety checks are performed on the ingested content before it is processed by the logic scoring phase.
[COMMAND_EXECUTION]: The skill instructs the agent to execute complex shell scripts for Git management (Step 4), memory synchronization (Step 7), and search index updates (Step 10). These scripts interpolate path variables ($OBSIDIAN_VAULT_PATH) and status values. If these variables or file paths contain shell-sensitive characters, they could lead to command injection in the underlying shell environment.

cross-linker