The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses subprocess.run within scripts/obsidian_adapter.py to execute the Obsidian CLI binary. The scripts/obsidian_cli.py wrapper allows the path to the executable to be provided via the --obsidian-binary argument. While the script uses list-based arguments to prevent shell injection, an attacker could potentially trick the agent into executing a malicious binary by manipulating this parameter.
[INDIRECT_PROMPT_INJECTION]: The workflow involves reading and processing source material and existing notes from a user's Obsidian vault (as seen in SKILL.md workflow steps 1 and 2, and references/doctrine.md). Since this content is external and potentially untrusted, it could contain instructions designed to influence the agent's behavior. The skill does not implement explicit boundary markers or instructions to ignore embedded prompts in ingested data.
Ingestion points: Workflow steps 1 and 2 in SKILL.md; scripts/verify_anki_notes.py reading vault files for verification.
Boundary markers: None identified; the skill relies on the structural 'DAE' formatting doctrine.
Capability inventory: Shell command execution (subprocess.run in obsidian_adapter.py), local network access (AnkiConnect in verify_anki_notes.py), and file system mutation (via the Obsidian CLI).
Sanitization: The skill provides instructions in references/remediation-context.md regarding 'quote-safe transport' and escaping Markdown math to prevent data corruption, but it lacks specific sanitization to prevent instruction injection.
[PRIVILEGE_ESCALATION]: Instructions in SKILL.md and references/remediation-context.md explicitly direct the agent to 'request approved unsandboxed CLI execution' if it encounters sandbox restrictions while trying to access the Obsidian local Unix socket (~/.obsidian-cli.sock). This encourages users to lower the agent's security boundaries to maintain functionality.

atomic-note