The Agent Skills Directory

[COMMAND_EXECUTION]: The skill automates complex workflows using system commands across multiple sections. The doc-maintenance skill executes git for branching, committing, and pushing code, and uses the GitHub CLI (gh) for PR creation. The defuddle and obsidian sections also rely on CLI-based execution for scraping and vault interaction.
[EXTERNAL_DOWNLOADS]: The skill instructs the agent to ensure the defuddle package is installed globally via npm install -g defuddle. This introduces an external dependency from the NPM registry that is not pinned to a specific version or hash.
[REMOTE_CODE_EXECUTION]: The obsidian-cli component documentation demonstrates the use of the obsidian eval command. This feature allows for the execution of arbitrary JavaScript within the environment of the running Obsidian application, which poses a significant risk if the tool is manipulated to execute malicious code provided via untrusted inputs.
[PROMPT_INJECTION]: The defuddle tool is used to ingest and parse data from arbitrary URLs. This capability creates a surface for indirect prompt injection, where an attacker could place malicious instructions on a web page to be processed by the agent. Although the skill mentions treating web content as hostile, the processing capability itself remains a notable risk factor.

knowledge