The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes several shell commands to manage the environment and sync data.
Evidence: Uses git rev-parse --show-toplevel to identify projects and ls to verify folder existence.
Evidence: Executes a multi-command shell string git -C "$V" add -A && git -C "$V" commit -m "<message>" && git -C "$V" push to synchronize changes.
[DATA_EXFILTRATION]: The skill is configured to automatically push local filesystem content to a remote Git repository.
Evidence: The 'Directory mode' instructions mandate that once files are written to the local vault at $HOME/Documents/obsidian/obsidian, the agent must stage all changes and execute a git push to the remote origin.
Risk: If the remote origin is misconfigured or if the vault contains sensitive information beyond the project plans, the agent may autonomously upload sensitive data to an external server.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8).
Ingestion points: Reads content from prd.md, plan.md, tech-spec.md, and direct user-pasted text (SKILL.md).
Boundary markers: Absent. The instructions do not specify delimiters or warnings to ignore instructions embedded within the source documents.
Capability inventory: The agent has the ability to write to the filesystem, modify existing index files, and perform git push operations.
Sanitization: Absent. There is no mention of filtering or escaping content read from external files before processing it.
Risk: A malicious PRD or engineering plan could contain hidden instructions that the agent might follow, leading to unauthorized file modifications or exfiltration of other notes in the vault.

ai-low-hanging-fruit