The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes shell commands such as rg (ripgrep) and a custom obsidian-wiki CLI to search through and synchronize agent histories. These commands are constructed by interpolating user-provided query strings directly into shell execution strings. This pattern is vulnerable to command injection; a query containing shell metacharacters (e.g., ;, &&, |, or backticks) could allow a malicious user or a malicious process providing the query to execute arbitrary commands on the host system.
[DATA_EXFILTRATION]: The skill is designed to read private conversation history files from various AI agents. These files are located in sensitive local paths including ~/.claude, ~/.codex, ~/.hermes, ~/.openclaw, and ~/.pi. This functionality exposes potentially sensitive personal or professional information to the AI agent's processing context, which constitutes data exposure of private chat logs.
[DYNAMIC_EXECUTION]: The skill dynamically generates shell commands at runtime. Specifically, in Step 4 and Step 7, it constructs commands like rg -i "<query terms>" <session.jsonl> and obsidian-wiki memory sync ... query="<query>". Because these commands incorporate untrusted user input into an executable command template without proper escaping or sanitization, they represent a significant dynamic execution risk.
[INDIRECT_PROMPT_INJECTION]: The skill processes raw, untrusted data from past AI agent conversations. This creates a vulnerability surface where instructions embedded in the history could influence the agent's current behavior during the distillation or synthesis phase.
Ingestion points: The skill reads from various history files including JSONL and Markdown files across multiple agent history roots (e.g., ~/.claude/projects/, ~/.pi/agent/sessions/).
Boundary markers: There are no specific instructions or delimiters mentioned that would prevent the agent from accidentally following instructions found within the ingested history blobs.
Capability inventory: The skill possesses the capability to read local files, write to the Obsidian vault, and execute various CLI tools.
Sanitization: No evidence of sanitization, filtering, or escaping of the extracted history content is provided before it is used to update wiki pages or generate synthesized answers.

wiki-agent