The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection vulnerability surface because it processes external, untrusted content and possesses write and execution capabilities.
Ingestion points: Reads arbitrary markdown files under $VAULT_PATH/**/*.md during tag audits and normalization procedures.
Boundary markers: Absent. There are no structured delimiters or specific instructions enforcing the separation of data from instructions within the parsed markdown pages.
Capability inventory: The skill modifies file contents (rewriting frontmatter tags, appending to log.md and hot.md) and executes local shell commands via the qmd CLI.
Sanitization: Absent. No filtering, validation, or escaping of the parsed file content or metadata is specified before rewriting files or calling commands.
[COMMAND_EXECUTION]: The skill invokes shell commands directly to update the QMD index.
Evidence: Automatically triggers commands such as ${QMD_CLI:-qmd} update and ${QMD_CLI:-qmd} get "qmd://$QMD_WIKI_COLLECTION/<page>.md". This introduces a secondary risk if variables or filenames extracted from untrusted vault paths are improperly handled during execution.

tag-taxonomy