The Agent Skills Directory

[PROMPT_INJECTION]: The skill demonstrates an indirect prompt injection surface by ingesting untrusted data from an external Obsidian vault. If an attacker can influence the content of notes or search results, they may inject malicious instructions that the agent could follow during processing.
Ingestion points: Untrusted data enters the agent context via obsidian-cli search and obsidian-cli open commands in SKILL.md.
Boundary markers: No delimiters or 'ignore instructions' warnings are used when processing retrieved note content.
Capability inventory: The skill possesses file read/write capabilities via obsidian-cli (create/append/list) and cat (reading local memory files).
Sanitization: There is no evidence of sanitization or content validation before external data is interpolated into commands or the agent's context.
[COMMAND_EXECUTION]: The skill relies on shell-based execution of obsidian-cli. It uses command substitution patterns like $(cat ~/.claude/memory/MEMORY.md) to populate command arguments. This pattern is vulnerable to shell injection if the source files (which are persistent memory) are modified to include shell-sensitive characters like backticks or semicolons.

c-obsidian