The Agent Skills Directory

[DATA_EXFILTRATION]: The skill accesses a sensitive local file path containing private meeting transcripts and notes at ~/Library/Application Support/Granola/cache-v3.json. While the skill lacks network capabilities to exfiltrate this data, the exposure of private meeting content to the agent's context is a significant privacy surface.
[COMMAND_EXECUTION]: The skill relies on executing a local Python script (scripts/granola.py) to query and manipulate the file system. The script uses standard libraries (pathlib, json, argparse) and does not invoke external shell commands or subprocesses.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it processes untrusted meeting transcripts and writes them to the Obsidian vault where the agent may later process them.
Ingestion points: The script reads raw JSON data from the Granola cache file in scripts/granola.py.
Boundary markers: Absent. Transcripts and notes are written to Markdown files without delimiters or warnings to ignore embedded instructions.
Capability inventory: The script performs file reads/writes via pathlib and directory creation. It does not have network access or dynamic execution capabilities.
Sanitization: Filenames are sanitized for illegal characters using regex, but the actual meeting content (notes and transcripts) is interpolated directly into the Markdown template without sanitization or escaping.

granola