The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill defines a system for ingesting and processing untrusted external data, which inherently creates an attack surface for indirect prompt injection.
Ingestion points: SKILL.md defines Layer 1 (Raw Sources) which includes articles, papers, notes, PDFs, conversation logs, bookmarks, and images processed via vision models.
Boundary markers: While the skill uses provenance markers (^[inferred], ^[ambiguous]) to tag generated output, it does not explicitly define sanitization or delimiters for the input stream to prevent malicious instructions within sources from influencing the agent.
Capability inventory: The skill uses the obsidian-wiki CLI for writing files, qmd for indexing, and standard shell tools (rg, grep, find) for retrieval.
Sanitization: The instructions focus on 'distillation' and 'synthesis' into Markdown but do not specify technical sanitization of input source content.
[COMMAND_EXECUTION]: The skill documentation and the references/MEMORY.md file describe the use of specific CLI tools (obsidian-wiki, qmd, rg) to manage the vault, update indices, and maintain atomic logs. These commands are integral to the skill's primary function of local knowledge management and do not involve downloading or executing untrusted remote code.

llm-wiki