The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the ~/Obsidian/Inbox/ directory. Maliciously crafted documents or metadata could attempt to influence the agent's decision-making during the classification and reconciliation steps. * Ingestion points: The agent is instructed to read files from ~/Obsidian/Inbox/ as the primary intake source. * Boundary markers: No explicit delimiters or instructions are provided to the agent to treat the inbox content as untrusted or to ignore embedded instructions. * Capability inventory: The skill utilizes shell commands (pdfinfo, pdftotext, tesseract, gs) and has write access to the local Obsidian vault. * Sanitization: While the skill mentions pseudonymizing third-party secrets, it does not provide instructions for sanitizing file content or filenames before they are processed by the agent.
[COMMAND_EXECUTION]: The OCR.md file contains shell command templates for processing PDFs. If the agent interpolates untrusted filenames from the inbox directory directly into these shell snippets without proper escaping, it could lead to arbitrary command execution on the host system.

file