The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data (PDFs, Web URLs, chat exports, and repositories) which serves as a major ingestion point for malicious instructions.
Ingestion points: The skill uses the Read tool to ingest local files and WebFetch or defuddle for external URLs.
Boundary markers: SKILL.md contains a specific 'Content Trust Boundary' section explicitly instructing the agent to ignore instructions found within source content.
Capability inventory: The agent has capabilities to write to the filesystem, execute CLI tools (obsidian-wiki, qmd), and run external Python scripts via shell commands.
Sanitization: Instructions emphasize distilling substance and synthesizing knowledge rather than following verbatim text, providing a layer of protection against accidental obedience.
[REMOTE_CODE_EXECUTION]: The file references/pageindex.md contains instructions to execute a Python script from an external repository (VectifyAI/PageIndex) using the command uv run --no-project python run_pageindex.py. This executes external code in the agent's environment.
[COMMAND_EXECUTION]: The skill makes extensive use of CLI tools and shell commands to manage the wiki state:
obsidian-wiki is used for cache management, manifest updates, and memory syncing.
qmd is used for vector database querying and indexing.
defuddle is used for processing web content for clean extraction.
Standard utilities like sha256sum, git, and mv are used for file operations and project detection.
[CREDENTIALS_UNSAFE]: The skill's configuration and the PageIndex integration rely on loading .env files, which the instructions in references/pageindex.md note are expected to contain sensitive credentials such as OPENAI_API_KEY.

wiki-ingest