The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes data from arbitrary Obsidian notes (tags, links, and frontmatter properties) without clear boundaries between data and instructions. An attacker could place malicious instructions in a note's properties that are then evaluated by the base file's formula or filter engine.
Ingestion points: Note metadata and content are accessed via properties like file.properties, file.tags, and file.links in SKILL.md.
Boundary markers: There are no explicit delimiters or instructions to the agent to ignore embedded commands within the processed data.
Capability inventory: The skill utilizes functions like file() for reading notes, link() for creating internal links, and html() for rendering content, which could be leveraged in an injection attack.
Sanitization: Although escapeHTML() is mentioned in references/FUNCTIONS_REFERENCE.md, its use is not mandated or demonstrated in the primary workflow, potentially allowing unsanitized input to be rendered as active HTML.
[COMMAND_EXECUTION]: The skill defines and executes a custom Domain-Specific Language (DSL) for formulas and filters. This dynamic execution environment processes data retrieved from the vault, performing computations and logic based on potentially untrusted metadata.

obsidian-bases