The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill includes an eval command (obsidian eval code="...") designed to execute JavaScript directly within the context of the Obsidian application. As an Electron-based application, Obsidian has access to the local filesystem and system APIs. This capability could be exploited to achieve arbitrary code execution on the user's host if the agent processes malicious input.
[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection due to its processing of external vault content. Ingestion points: Operations like obsidian read, obsidian search, and plugin development workflows where the agent reads file content. Boundary markers: The skill protocols mention treating external data as hostile, but there are no technical delimiters or instructions to ignore embedded commands in the data returned by the tools. Capability inventory: The skill combines high-privilege capabilities such as dynamic code execution (eval), file writing (create, append), and visual capture (dev:screenshot). Sanitization: No explicit sanitization or validation mechanisms are defined for data interpolated into command parameters or the eval execution string.
[COMMAND_EXECUTION]: The skill functions by invoking a local CLI tool (obsidian) to interact with the filesystem and application state, allowing for extensive manipulation of the user's data environment.
[DATA_EXFILTRATION]: The skill provides developer tools for capturing screenshots (dev:screenshot) and inspecting the DOM (dev:dom) of the application. These capabilities could be misused by a malicious actor to exfiltrate visual information or sensitive metadata from the Obsidian workspace.

obsidian-cli