The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes markdown files from the user's vault to generate health reports, perform searches, and triage notes. This creates a surface where malicious instructions embedded in a note (e.g., hidden in comments or metadata) could be read by the agent and executed.
Ingestion points: SearchVault.py reads file content for simple and Dataview searches; VaultManager.py reads notes to extract frontmatter and links.
Boundary markers: No specific boundary markers or instructions to ignore embedded commands were found in the utility scripts.
Capability inventory: The skill includes scripts that can write files (NoteCreator.py), move or delete files (VaultManager.py), and interact with a local API to execute commands within Obsidian.
Sanitization: The scripts handle note content as raw text without sanitization or validation against prompt injection patterns.
[COMMAND_EXECUTION]: The Python and Bash utility scripts (VaultManager.py, NoteCreator.py, obsidian-vault.sh) implement file system operations like moving, reading, and creating files based on user-provided paths. The move command in VaultManager.py does not perform strict path validation, which could potentially allow operations on files outside the intended vault directory via path traversal (e.g., using .. in paths).
[EXTERNAL_DOWNLOADS]: The documentation references several third-party tools and plugins from the Obsidian community (e.g., obsidian-cli, Advanced URI, Dataview). It provides standard installation commands for these tools. These are well-known resources within the Obsidian ecosystem.

obsidian