The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests arbitrary Markdown content from Obsidian notes to generate a digest via AI summarization, creating a surface for indirect prompt injection.
Ingestion points: Note content read from the local Obsidian vault is used as input for the summarization step.
Boundary markers: The instructions for the AI summarization step lack explicit boundary markers or directions to ignore embedded instructions within the source note.
Capability inventory: The skill possesses the ability to read files, execute shell commands, and interact with the Weixin API via node-wxcli.
Sanitization: No sanitization is performed on the Markdown content before it is passed to the AI for summarization.
[COMMAND_EXECUTION]: The workflow utilizes shell commands that incorporate variables such as note titles and paths, which can be an attack surface for injection if not strictly validated by the platform.
Evidence: Shell commands such as cat "$vault_path/<note_path>" and obsidian-cli search "<note_title>" are used to process note data.
Risk: Maliciously crafted note paths or titles could potentially lead to directory traversal or command injection if inputs are not properly escaped.
[EXTERNAL_DOWNLOADS]: The skill automatically downloads remote assets if an Obsidian note contains external image references.
Evidence: Step 4.2 specifically handles remote URLs by downloading them to a temporary file before processing.

obsidian-to-weixin