ingest
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external URLs, files, and an 'Inbox' source, creating an attack surface where malicious content could influence the agent's actions during the ingestion and note-creation process.
- Ingestion points: The skill fetches content from user-supplied URLs and reads external or 'Inbox' files as defined in Step 1 of SKILL.md.
- Boundary markers: There are no explicit markers or instructions provided to the agent to treat the fetched content as data rather than instructions, potentially leading to accidental obedience of embedded commands.
- Capability inventory: The skill possesses file-write capabilities (creating and modifying Markdown files in the vault) and execution capabilities via the Obsidian CLI (
obsidian open). - Sanitization: A mitigation is present in Step 5, which explicitly instructs the agent: 'Never interpolate generated Markdown into shell commands.' This reduces the risk of the ingested content being used to execute arbitrary commands.
- [COMMAND_EXECUTION]: The skill invokes an external CLI tool to interact with the host system's Obsidian application.
- Evidence: Step 5 of SKILL.md specifies the execution of
obsidian open path="<vault-relative Atomic Note path>"to activate the processed note in the user interface.
Audit Metadata