The Agent Skills Directory

[SAFE]: The skill operates entirely on the local file system, performing tasks such as creating directories, writing Markdown files, and auditing vault structure. No network operations or external data exfiltration patterns were detected.
[COMMAND_EXECUTION]: The skill executes a local Python script (scripts/vault.py) for core logic. The script employs yaml.safe_load for parsing document frontmatter, which prevents unsafe object instantiation during metadata processing.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data sources such as transcripts and research notes. It mitigates potential risks by including explicit instructions to treat these sources as evidence only, warning that transcript text must not trigger arbitrary execution.
[DYNAMIC_EXECUTION]: The test suite (scripts/test_vault.py) dynamically loads the main script using importlib.util. This is a standard practice for unit testing and uses a static path relative to the test file, posing no security risk.

open-knowledge-vault