The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies on the obsidian CLI to perform all actions. This grants the agent the ability to execute commands that modify the local filesystem (create, append) and interact with a running application instance.
[REMOTE_CODE_EXECUTION]: The obsidian eval command enables the execution of arbitrary JavaScript code within the context of the Obsidian application. This is a high-risk capability that allows for complex, potentially malicious logic to be run under the guise of plugin development or vault inspection.
[DATA_EXFILTRATION]: The skill provides multiple methods to access sensitive user data, creating an exfiltration risk:
obsidian read and obsidian search allow full access to the contents of the user's vaults.
obsidian dev:console grants access to application logs which may contain sensitive runtime information or plugin secrets.
obsidian dev:screenshot allows capturing visual data of the user's workspace.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection. Since it is designed to read and search vault content, it may ingest untrusted data from notes created by third parties or external processes.
Ingestion points: obsidian read, obsidian search, obsidian dev:console, and obsidian dev:dom (SKILL.md).
Boundary markers: None present; content is processed directly.
Capability inventory: The skill can write files (obsidian create), execute code (obsidian eval), and access the network if the user has other network-enabled tools installed.
Sanitization: No evidence of input validation or instruction filtering for ingested data.

obsidian-cli