The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill implements an obsidian eval command which allows the agent to execute arbitrary JavaScript code within the Obsidian application context. This presents a risk if the code passed to the command is influenced by untrusted external data.
Evidence: The pattern obsidian eval code="..." is documented for running JavaScript in the app context.
[INDIRECT_PROMPT_INJECTION]: The skill allows the agent to ingest vault data and application logs, creating an attack surface where malicious content could influence the agent's subsequent actions.
Ingestion points: Data enters the context via obsidian read, obsidian search, obsidian dev:errors, and obsidian dev:console (all in SKILL.md).
Boundary markers: No explicit delimiters or instruction-ignoring markers are provided in the skill instructions to separate vault data from agent instructions.
Capability inventory: The skill possesses the ability to read and write files in the vault and execute arbitrary code via the eval tool.
Sanitization: No sanitization or validation mechanisms are described for content retrieved from the vault.
[COMMAND_EXECUTION]: The skill uses a command-line interface to interact with the system, including taking screenshots and querying the application's DOM.
Evidence: obsidian dev:screenshot and obsidian dev:dom commands in SKILL.md.

obsidian-cli