The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill enables the agent to read and process external Markdown notes from an Obsidian vault, which creates an attack surface for indirect prompt injection where malicious instructions hidden in notes could be executed by the agent.
Ingestion points: Content is ingested through obsidian read commands, shell cat operations on vault files, and grep search functionality.
Boundary markers: No specific delimiters or "ignore embedded instructions" warnings are implemented when processing note content.
Capability inventory: The skill possesses extensive capabilities including file system modification (create, append, move, delete), shell command execution, and arbitrary JavaScript execution via obsidian eval.
Sanitization: The skill does not appear to sanitize or validate content retrieved from external files before processing it.
[DYNAMIC_EXECUTION]: The skill documents the obsidian eval command in cli-reference.md and changelog.md, which allows for the execution of arbitrary JavaScript within the Obsidian application context. Although listed as a developer command, it represents a potential vector for dynamic code execution.
[COMMAND_EXECUTION]: Several bash helper functions provided in reference.md (such as obs-session and obs-task) use shell variables within unquoted heredocs or command arguments. This could lead to command injection if an agent or user provides unsanitized input to these helpers.
[PERSISTENCE]: The documentation in SKILL.md and reference.md instructs the user to modify their shell configuration files (.zshrc or .bashrc) to add environment variables and helper functions. While these are standard configuration practices for this integration, modifying startup scripts is a common technique for establishing persistence.

obsidian