The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill reads note bodies to derive topical queries and category tags, which creates a surface for indirect prompt injection where malicious text in a note could attempt to override agent instructions. This is mitigated by several strong design choices:
Ingestion points: The skill ingests markdown content from notes via the Read tool and processes it in SKILL.md and references/kandidaten-auswahl.md.
Boundary markers: Instructions explicitly mandate stripping wikilink brackets, blockquotes, and footnote references before processing queries. A dedicated Python mutator is used to isolate the YAML frontmatter from the note body during write operations.
Capability inventory: The skill utilizes python3 via the Bash tool, alongside Read, Write, and Edit. It also executes CLI tools like qmd and prettier.
Sanitization: The embedded Python scripts use yaml.safe_load() for frontmatter parsing and implement a SHA-256 body hash verification to ensure note contents are never inadvertently modified during metadata updates.
[DYNAMIC_EXECUTION]: The skill provides comprehensive Python script snippets in its reference files (references/frontmatter-bearbeitung.md, references/kandidaten-auswahl.md, references/kategorien-registry.md) for the agent to execute via python3. These scripts are used for complex tasks like atomic frontmatter mutation and batch selection. They are implemented with safety in mind, using temporary files for atomic writes and performing rollbacks on verification failure.
[COMMAND_EXECUTION]: The skill instructs the agent to use several CLI tools (qmd, prettier, obsidian) and python3 to manage the vault. All operations are strictly scoped to the vault root, and the skill includes an 'Absolute Verbote' (Absolute Prohibitions) section that explicitly forbids file deletion, movement, or any writes outside the designated root directory.

obsidian-connect-notes