The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources (graph.json and OKF markdown bundles) to reconstruct wiki pages and update vault metadata.
Ingestion points: Data is read from graph.json (Step 1) and markdown files within the OKF bundle directory (Step 4-OKF).
Boundary markers: The instructions do not define delimiters or specific safety warnings to prevent the agent from processing or obeying instructions that might be embedded in the imported markdown bodies or JSON summary fields.
Capability inventory: The skill has broad file-system write access to the $OBSIDIAN_VAULT_PATH, including the ability to create new directories, write new markdown files, and modify central vault files like .manifest.json, index.md, and log.md.
Sanitization: There is no evidence of content sanitization or validation of metadata fields (tags, summaries, relationships) before they are written to the filesystem.
[COMMAND_EXECUTION]: The skill dynamically constructs file paths for writing based on identifiers provided in the external source files.
Evidence: In Step 4-Graph, the path is computed as page_path = $VAULT/<node.id>.md. In Step 4-OKF, the concept ID is derived from the relative path of files in the bundle. If a malicious source file provides an ID containing directory traversal sequences (e.g., ../../target/file), the skill could potentially be manipulated into writing files outside the intended vault directory structure.

wiki-import