The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes an external CLI tool obsidian to perform numerous operations, including the obsidian eval command which allows for the execution of arbitrary JavaScript code (code="...") within the Obsidian application environment. This dynamic execution capability can be abused if the agent is manipulated into running malicious scripts.
[DATA_EXFILTRATION]: The skill enables extensive access to private user data stored in Obsidian vaults through commands like obsidian read, obsidian search, and obsidian daily:read. This functionality creates a significant attack surface for the exposure of sensitive information if an agent is instructed to exfiltrate note contents.
[EXTERNAL_DOWNLOADS]: The skill references official documentation at https://help.obsidian.md/cli. This is an informative reference to a well-known service and is considered safe.
[COMMAND_EXECUTION]: The skill includes developer-focused commands that can interact with the system environment, such as obsidian dev:screenshot which writes files to the local disk at user-defined or computed paths.

obsidian-cli