The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill hardcodes absolute filesystem paths specific to a single user environment (/Users/mtm/Documents/Obsidian Vault). This exposes the local username and system directory structure in the instructions.
[COMMAND_EXECUTION]: The skill directs the agent to execute system commands including rg (ripgrep) and git commit. While these are used for the primary purpose of the skill, they provide the agent with broad read and write capabilities across the local vault directory.
[INDIRECT_PROMPT_INJECTION]: The skill processes arbitrary note content and uses it to drive vault-wide operations, creating a vulnerability surface.
Ingestion points: The agent reads the content of Obsidian notes and specifically processes headings and link text from the vault files (SKILL.md).
Boundary markers: There are no explicit boundary markers or instructions to treat embedded text as data rather than instructions when reading notes.
Capability inventory: The agent uses rg to perform multi-file searches and git commit to finalize edits to those files (SKILL.md).
Sanitization: There is no evidence of sanitization or escaping applied to the heading text extracted from notes before it is used in search-and-replace operations.

outline-headings