The Agent Skills Directory

[COMMAND_EXECUTION]: The skill implements a 'Research Backends' feature that reads shell command templates from a local file (references/research-backends.md) and executes them using the system shell. It also executes management commands like obsidian-wiki memory sync and qmd update directly in the shell.
[REMOTE_CODE_EXECUTION]: The backend execution mechanism performs string substitution on the invoke template (e.g., {url}, {query}) and executes the resulting string in a shell. This represents a command injection vector if the substituted values contain shell metacharacters, potentially allowing an attacker to execute arbitrary code.
[DYNAMIC_EXECUTION]: The skill dynamically constructs and executes executable content at runtime by loading command strings from a data file and populating them with external inputs.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external websites to synthesize research results and create wiki pages, creating a vulnerability to indirect prompt injection.
Ingestion points: External content fetched via WebSearch, WebFetch, and custom CLI backends.
Boundary markers: The instructions lack explicit boundary markers or warnings for the agent to disregard instructions embedded within the fetched content.
Capability inventory: The agent has the ability to write multiple files to the local file system (Obsidian vault) and execute shell-based indexing and logging tools (obsidian-wiki memory sync, qmd).
Sanitization: There is no evidence of sanitization or filtering applied to external content before it is processed by the agent.

wiki-research