The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the Python subprocess module to call the git CLI and internal helper scripts. \n
Evidence: scripts/kb_common.py uses subprocess.check_output with a list of arguments to find the repository root using git rev-parse. \n
Evidence: scripts/kb_lint.py executes other Python scripts in the skill (e.g., kb_index_check.py) to aggregate system health reports. \n
Context: These operations are performed safely using list-based arguments rather than shell strings, preventing typical command injection vectors. \n- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted Markdown and Canvas data and has the capability to modify or delete files based on that data. \n
Ingestion points: scripts/kb_lint.py, scripts/kb_registry_check.py, and scripts/kb_common.py read all .md and .canvas files within the research project to find wikilinks and registry data. \n
Boundary markers: The skill does not define specific delimiters or override instructions when reading user note content. \n
Capability inventory: The skill has tools for deleting directories (shutil.rmtree in project_kb.py), deleting notes (unlink), and performing destructive renames, which could lead to data loss if an agent is tricked into executing them via malicious content in a processed note. \n
Sanitization: Data read from files is matched against regex patterns but is not specifically sanitized before being used in lifecycle logic.

obsidian-project-kb-core