The Agent Skills Directory

[DATA_EXPOSURE]: The script scripts/olrapi.sh reads the sensitive local configuration file ~/.claude.json. It specifically extracts authentication tokens and connection settings for the Obsidian API to automate request authorization.\n- [DYNAMIC_EXECUTION]: An embedded Python script is used within the shell wrapper to parse JSON configuration data. This script is executed at runtime via a heredoc to dynamically resolve environment settings.\n- [INDIRECT_PROMPT_INJECTION]: The skill presents an attack surface for indirect prompt injection as it processes vault content and paths provided by the agent. Ingestion points: Command line arguments PATH_ and extra arguments ($@) in scripts/olrapi.sh. Boundary markers: None identified in the script logic. Capability inventory: Execution of curl with arbitrary headers and data via scripts/olrapi.sh. Sanitization: No input validation or escaping is performed on the paths or parameters before they are passed to the curl command.

obsidian-rest-api