The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes user-controlled Markdown notes which are interpolated into LLM prompts without proper escaping, creating a potential injection surface.
Ingestion points: scripts/collect_model_judgments.py and scripts/prepare_model_judgment.py read content from Markdown files within the Obsidian vault for model evaluation.
Boundary markers: The scripts use NOTE_CONTENT_START and NOTE_CONTENT_END as markers to delimit the note content within the prompt sent to the LLM.
Capability inventory: Model judgment results can trigger vault modifications via the Obsidian CLI (in scripts/obsidian_adapter.py) and influence automated remediation recommendations.
Sanitization: There is no escaping or filtering of the NOTE_CONTENT_END sequence in the note content. A malicious note containing this marker could terminate the data block and inject unauthorized instructions into the model judgment context.
[COMMAND_EXECUTION]: The skill utilizes subprocess.run to execute external binaries and commands for core functionality.
scripts/collect_model_judgments.py executes external LLM runners (like codex) or user-defined command templates.
scripts/obsidian_adapter.py and scripts/obsidian_cli.py invoke the Obsidian CLI binary to perform vault operations.
The scripts implement standard security mitigations, such as using list-based arguments and shlex.split, to reduce the risk of shell injection.

atomic-note-audit