The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's operational logic, data schema, and processing rules are deferred to external, untrusted content stored in an Obsidian vault.
Ingestion points: The agent is instructed to read /Users/mtm/Documents/Obsidian Vault/bargainbadger.md and all linked notes before performing any actions.
Boundary markers: The skill lacks delimiters or warnings to ignore potentially malicious instructions embedded in the vault notes. It explicitly treats external content as an authoritative specification ("Everything factual... lives in the vault").
Capability inventory: The skill possesses the ability to read and write files within the vault, create scratch files, and execute generated code for calculations.
Sanitization: No sanitization or validation is performed on the data or links retrieved from the vault notes.
[DATA_EXPOSURE]: The skill is vulnerable to path traversal and environment exposure.
The instruction to "Resolve a wikilink by joining the vault path and the link text with a .md suffix" enables path traversal if a link in the vault contains ../ sequences, allowing the agent to read files outside the user's Documents folder.
The hardcoding of an absolute user path (/Users/mtm/) exposes the host's directory structure and specific user identification.
[DYNAMIC_EXECUTION]: The skill requires the agent to "Compute every derived price in code, never by hand." Because the logic for these computations is retrieved from external untrusted notes, there is a risk that an attacker could influence the generated code to perform unauthorized operations or data exfiltration.

bargainbadger-price-update