The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions direct the agent to execute shell commands, such as qmd query "<topic>", where the topic is derived from user-supplied $ARGUMENTS. This direct interpolation without sanitization allows for command injection attacks if a user provides shell metacharacters (e.g., ;, `, or $(...)) to execute arbitrary code on the host system.\n- [PROMPT_INJECTION]: The skill implements a workflow that ingests data from a personal Obsidian vault, creating a surface for indirect prompt injection.\n
Ingestion points: The skill reads the index.md file and subsequent Markdown files from the local vault path /Users/kriscard/obsidian-vault-kriscard/ using the obsidian read and qmd get tools.\n
Boundary markers: The instructions do not define boundary markers to encapsulate the ingested data, which increases the risk that malicious instructions hidden within the vault's notes could be interpreted and followed by the agent.\n
Capability inventory: The agent has the capability to execute shell commands through the qmd and obsidian CLI tools and then process the resulting data to generate responses.\n
Sanitization: There is no evidence of sanitization, filtering, or validation of the vault content before it is interpolated into the agent's context for synthesis.

memory-recall